FFMPEG · CVE-2026-125229 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg's huffyuv and ffvhuff encoders do not check minimum frame dimensions when using the median predictor. A tiny input video, such as a 2-pixel-wide frame, causes out-of-bounds reads and writes that crash the encoder.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg (through 9.0.2) to encode video to huffyuv or ffvhuff with the median predictor, especially services transcoding user-uploaded video. A frame 2 pixels wide, or 1-2 pixels tall, triggers out-of-bounds reads and writes in the encoder; the sources describe a crash. Pipelines that never use these two codecs, or only process trusted media, can skip it.
Not affected if codec-not-used, non-huffyuv-encoder, trusted-input-only
Who cares ffmpeg, huffyuv, media-processing, video-transcoding
ffmpeg -version9.0.2 or older and has no backport of commit 45f98d08, and you transcode untrusted video with -c:v huffyuv or -c:v ffvhuff (median predictor, the default), you are exposedFrame too small for the median predictorFFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encode_frame() function of libavcodec/huffyuvenc.c, because encode_init() never validates minimum frame dimensions for the median predictor. Attackers can supply a tiny video, such as a 2-pixel-wide or 1-2-pixel-tall frame, that causes negative sub_median_pred lengths and out-of-bounds reads and writes when transcoded to huffyuv or ffvhuff, crashing the encoder.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
through 9.0.29.0.2