FFmpeg versions through 9.0.2 suffer from an out-of-bounds write in the V4L2 M2M encoder path. The flaw occurs when cumulative plane offsets are not validated against the buffer length, allowing crafted video input to cause an unsigned wraparound that makes a memcpy write past the mmaped driver buffer. This flaw is classified as CWE‑787 and can lead to arbitrary code execution, privilege escalation, or denial of service by corrupting memory while encoding video streams.

The vulnerability affects the FFmpeg multimedia framework, including all builds using the default libavcodec v4l2_buffers implementation up to and including release 9.0.2. Users must verify that they are running a version earlier than 9.0.3 or later, which incorporates the patch.

The CVSS score is 7.3, indicating a high severity. No EPSS score was reported, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local or remote via delivery of malicious video data to a process running FFmpeg with V4L2 M2M encoding enabled. An attacker capable of controlling the input can trigger the out-of-bounds write, potentially compromising the process or host. The mitigation requires applying a patched FFmpeg build or otherwise preventing the vulnerable code path from executing with untrusted input.