EUVD-2026-76636
GHSA-8cqc-p4qr-2jqq
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privileges (video group) required; heap OOB write yields full C/I/A impact once the vicodec device is accessible and a 4-component format is configured.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: vicodec: fix out-of-bounds write in FWHT encoder
vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the compressed descriptor pixfmt_fwht, whose sizeimage_mult is 3: coded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). fwht_encode_frame() encodes one plane per component, and an incompressible plane takes the FWHT_FRAME_UNENCODED path in encode_plane(), copying the plane verbatim.
For a 4-component pixel format all four planes are full resolution (width_div height_div 1), so a frame that forces every plane through the unencoded fallback writes sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning the plane by coded_w * coded_h, which can result in corruption of adjacent kernel heap memory.
Bump pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest components_num among the supported raw formats, so the capture buffer is always large enough for the unencoded fallback.
AnalysisAI
Heap out-of-bounds write in the Linux kernel vicodec virtual video codec driver's FWHT encoder allows a local low-privileged user to corrupt adjacent kernel heap memory, potentially enabling privilege escalation to root. The root cause is an undersized CAPTURE buffer: the encoder allocates output using a size multiplier of 3, but 4-component pixel formats whose planes all hit the FWHT_FRAME_UNENCODED verbatim-copy fallback require a multiplier of 4, producing a per-frame overflow of coded_w × coded_h bytes into adjacent slab memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the vicodec kernel module must be present and loaded - CONFIG_VIDEO_VICODEC must be enabled at build time, which is not the default for most production distributions; (2) the attacker must have read-write access to the vicodec V4L2 device node (typically /dev/videoX), ordinarily requiring membership in the 'video' group or a permissive udev rule; (3) a 4-component pixel format in which width_div == height_div == 1 for all four planes must be selected via VIDIOC_S_FMT; (4) at least one submitted frame must have all four planes resist FWHT compression, triggering the FWHT_FRAME_UNENCODED verbatim-copy fallback for every component. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-calibrated: exploitation is strictly local, requires at minimum membership in the video device group, and produces a high-impact kernel heap write. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel: Linux 6.12.109, 6.18.50, 7.2.4, or any build based on 7.3-rc1 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify systems with vicodec kernel module enabled, prioritizing virtualization hosts and container platforms granting unprivileged user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today