{"id":"CVE-2026-125229","kind":"vulnerability","aliases":["CVE-2026-125229"],"related":[],"title":"FFmpeg: tiny video frames crash the huffyuv encoder via out-of-bounds memory access","description":"FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encode_frame() function of libavcodec/huffyuvenc.c, because encode_init() never validates minimum frame dimensions for the median predictor. Attackers can supply a tiny video, such as a 2-pixel-wide or 1-2-pixel-tall frame, that causes negative sub_median_pred lengths and out-of-bounds reads and writes when transcoded to huffyuv or ffvhuff, crashing the encoder.","summary":"FFmpeg's huffyuv and ffvhuff encoders do not check minimum frame dimensions when using the median predictor. A tiny input video, such as a 2-pixel-wide frame, causes out-of-bounds reads and writes that crash the encoder.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","huffyuv","media-processing","runtime","video-transcoding"],"not_affected_if":["codec-not-used","non-huffyuv-encoder","trusted-input-only"],"how_to_check":"Run 'ffmpeg -version'. If it is 9.0.2 or older and has no backport of commit 45f98d08, and you transcode untrusted video with -c:v huffyuv or -c:v ffvhuff (median predictor, the default), you are exposed. Also grep your pipeline configs for huffyuv/ffvhuff. Patched builds refuse tiny frames with 'Frame too small for the median predictor'.","fix":"Fixed in FFmpeg git commit 45f98d0819efe2b7ce93e9034b7e6a4ed6700621 (avcodec/huffyuvenc: reject frames too small for the median predictor). No release version stated; affected is 'through 9.0.2'. Update to a build that includes this commit, or check the FFmpeg release notes for the first release after 9.0.2.","status":"open","published_at":"2026-11-09T19:17:00+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","triaged_at":"2026-11-09T19:29:29+00:00","updated_at":"2026-11-09T19:32:40+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T19:29:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FFmpeg: tiny video frames crash the huffyuv encoder via out-of-bounds memory access","impact":"medium","summary":"FFmpeg's huffyuv and ffvhuff encoders do not check minimum frame dimensions when using the median predictor. A tiny input video, such as a 2-pixel-wide frame, causes out-of-bounds reads and writes that crash the encoder.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","video-transcoding"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Encoder crashes on attacker-supplied tiny video; memory corruption possible","analyst_note":"Confirm fixed FFmpeg version and exact conditions from the linked patch (github.com) and VulnCheck advisory.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["trusted-input-only","codec-not-used"],"who_is_affected":"Systems that transcode user-supplied video to huffyuv or ffvhuff with FFmpeg are exposed, since attacker-chosen tiny frames trigger the flaw. The sources do not say which FFmpeg versions are fixed beyond the description's 'through 9.0.2'. Pipelines that only process trusted media or do not use these codecs can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4670,"output_tokens":533,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm fixed FFmpeg version and exact conditions from the linked patch (github.com) and VulnCheck advisory.","search":"'-125229':18A,21A '-2':119C '-2026':17A,20A '1':118C '2':56B,113C '9.0.2':75C 'access':15A,83C 'attack':104C 'bound':13A,65B,81C,135C 'caus':61B,125C 'check':40B 'contain':76C 'crash':5A,70B,145C 'cve':16A,19A 'dimens':43B,99C 'encod':8A,37B,72B,87C,93C,147C 'ffmpeg':1A,22A,23B,32B,73C 'ffvhuff':36B,144C 'frame':4A,42B,60B,88C,98C,123C 'function':89C 'huffyuv':7A,24B,34B,142C 'init':94C 'input':51B 'length':130C 'libavcodec/huffyuvenc.c':91C 'media':26B 'media-process':25B 'median':47B,102C,128C 'memori':14A,82C 'minimum':41B,97C 'negat':126C 'never':95C 'out-of-bound':10A,62B,78C,132C 'pixel':58B,115C,121C 'pixel-tal':120C 'pixel-wid':57B,114C 'pred':129C 'predictor':48B,103C 'process':27B 'read':66B,136C 'runtim':28B 'sub':127C 'suppli':106C 'tall':122C 'tini':2A,50B,108C 'transcod':31B,140C 'use':45B 'valid':96C 'via':9A 'video':3A,30B,52B,109C 'video-transcod':29B 'vulner':84C 'wide':59B,116C 'write':68B,138C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg (through 9.0.2) to encode video to huffyuv or ffvhuff with the median predictor, especially services transcoding user-uploaded video. A frame 2 pixels wide, or 1-2 pixels tall, triggers out-of-bounds reads and writes in the encoder; the sources describe a crash. Pipelines that never use these two codecs, or only process trusted media, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","huffyuv","mediaprocessing","runtime","videotranscoding"],"campaign_type":null,"search_a":"'-125229':18A,21A '-2026':17A,20A 'access':15A 'bound':13A 'crash':5A 'cve':16A,19A 'encod':8A 'ffmpeg':1A,22A 'frame':4A 'huffyuv':7A 'memori':14A 'out-of-bound':10A 'tini':2A 'via':9A 'video':3A","search_b":"'2':56B 'bound':65B 'caus':61B 'check':40B 'crash':70B 'dimens':43B 'encod':37B,72B 'ffmpeg':23B,32B 'ffvhuff':36B 'frame':42B,60B 'huffyuv':24B,34B 'input':51B 'media':26B 'media-process':25B 'median':47B 'minimum':41B 'out-of-bound':62B 'pixel':58B 'pixel-wid':57B 'predictor':48B 'process':27B 'read':66B 'runtim':28B 'tini':50B 'transcod':31B 'use':45B 'video':30B,52B 'video-transcod':29B 'wide':59B 'write':68B","search_c":"'-2':119C '1':118C '2':113C '9.0.2':75C 'access':83C 'attack':104C 'bound':81C,135C 'caus':125C 'contain':76C 'crash':145C 'dimens':99C 'encod':87C,93C,147C 'ffmpeg':73C 'ffvhuff':144C 'frame':88C,98C,123C 'function':89C 'huffyuv':142C 'init':94C 'length':130C 'libavcodec/huffyuvenc.c':91C 'median':102C,128C 'memori':82C 'minimum':97C 'negat':126C 'never':95C 'out-of-bound':78C,132C 'pixel':115C,121C 'pixel-tal':120C 'pixel-wid':114C 'pred':129C 'predictor':103C 'read':136C 'sub':127C 'suppli':106C 'tall':122C 'tini':108C 'transcod':140C 'valid':96C 'video':109C 'vulner':84C 'wide':116C 'write':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125229","severity":null,"published_at":"2026-11-09T19:17:00+00:00","modified_at":"2026-11-09T19:17:00+00:00","first_seen_at":"2026-11-09T19:28:20+00:00","fetched_at":"2026-11-09T19:28:20+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125229:2324","url":null,"severity":null,"published_at":"2026-11-09T19:32:40+00:00","modified_at":"2026-11-09T19:32:40+00:00","first_seen_at":"2026-11-09T19:32:40+00:00","fetched_at":"2026-11-09T19:32:40+00:00","note":"Read FFmpeg commit 45f98d08 (via WebFetch; web-cli out of Exa credits) and VulnCheck advisory. Fix is a source commit adding a size check in encode_init; no release containing it is named on either page, so fixed version unknown. Nothing marked verified."}],"documents":[{"id":109348,"url":"https://github.com/FFmpeg/FFmpeg/commit/45f98d0819efe2b7ce93e9034b7e6a4ed6700621","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109349,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-memory-access-in-huffyuv-ffvhuff-median-predictor","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}