Who is not affected by CVE-2026-125256?

Q: Who is not affected by CVE-2026-125256?

Not affected if: no-huffyuv-encoding, no-untrusted-media, non-risc-v-hosts, non-riscv, rvv-disabled.

HIGH7.3CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

FFMPEG · CVE-2026-125256 · Package

FFmpeg: narrow RGB video overflows heap on RISC-V Huffyuv encoding

NO FIX YET · SEE WHAT TO DO

FFmpeg through 9.0.2 has a heap buffer overflow in the RISC-V vector (RVV) Huffyuv encoder routine ff_llvidenc_diff_bytes_rvv(). Supplying RGB video narrower than 8 or 16 pixels makes a negative length write past the encoder's temporary buffer, corrupting heap memory.

first public Nov 9, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

FFmpeg 7.0 through 9.0.2 built for RISC-V with the vector extension (RVV) enabled, when it encodes RGB video to Huffyuv. A user-supplied very narrow video (under 8 or 16 pixels wide) causes a heap write past the temporary buffer. Everyone on x86, ARM or non-RVV builds, and anyone who never encodes to Huffyuv, can skip it.

ffmpeg>= 7.0, <= 9.0.2 (RISC-V RVV builds)

Not affected if no-huffyuv-encoding, no-untrusted-media, non-risc-v-hosts, non-riscv, rvv-disabled

Who cares ffmpeg, huffyuv, media-transcoding, risc-v, rvv

02 · How to check

Only RISC-V builds with RVV are affected (x86, ARM and other builds do not contain this code)
Run ffmpeg -version and check the configuration for a riscv target, and whether libavcodec/riscv/llvidencdsp_rvv.S is built in
Then check whether you encode untrusted video to Huffyuv (-c:v huffyuv), especially RGB input narrower than 16 pixels
Check that your source contains commit 1f7bdea

03 · The fix

No released version confirmed
Fixed in FFmpeg master by commit 1f7bdea654a8a9a1761759e22d83943371cff21f; build from a tree containing it or wait for a release newer than 9.0.2 that includes it

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 9, 2026

How it unfolded

2 events · Nov 9, 2026 → Nov 9, 2026

Nov 9, 202620:48 UTCNVD CVE-2026-125256
Nov 9, 202620:51 UTCInfraStack Analyst Read FFmpeg commit 1f7bdea (only libavcodec/riscv/llvidencdsp_rvv.S changed: early return when length <= 0) and VulnCheck advisory (7.0 through 9.0.2). No fixed release named in either; web-cli was out of credits so release tags unchecked. Non-RVV builds unaffected since the code is RISC-V assembly only.moreless

What the sources say, verbatim

365 characters

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer.

Sources and references

NVD: CVE-2026-125256Nov 9, 2026
Patch: github.comFix · github.com
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com

This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next Ffmpeg threat the day it hits your stack.

Start free

Post Share

HIGH7.3CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

FFMPEG · CVE-2026-125256 · Package

FFmpeg: narrow RGB video overflows heap on RISC-V Huffyuv encoding

NO FIX YET · SEE WHAT TO DO

first public Nov 9, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

ffmpeg>= 7.0, <= 9.0.2 (RISC-V RVV builds)

Not affected if no-huffyuv-encoding, no-untrusted-media, non-risc-v-hosts, non-riscv, rvv-disabled

Who cares ffmpeg, huffyuv, media-transcoding, risc-v, rvv

02 · How to check

Only RISC-V builds with RVV are affected (x86, ARM and other builds do not contain this code)
Run ffmpeg -version and check the configuration for a riscv target, and whether libavcodec/riscv/llvidencdsp_rvv.S is built in
Then check whether you encode untrusted video to Huffyuv (-c:v huffyuv), especially RGB input narrower than 16 pixels
Check that your source contains commit 1f7bdea

03 · The fix

No released version confirmed
Fixed in FFmpeg master by commit 1f7bdea654a8a9a1761759e22d83943371cff21f; build from a tree containing it or wait for a release newer than 9.0.2 that includes it

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 9, 2026

How it unfolded

2 events · Nov 9, 2026 → Nov 9, 2026

Nov 9, 202620:48 UTCNVD CVE-2026-125256
Nov 9, 202620:51 UTCInfraStack Analyst Read FFmpeg commit 1f7bdea (only libavcodec/riscv/llvidencdsp_rvv.S changed: early return when length <= 0) and VulnCheck advisory (7.0 through 9.0.2). No fixed release named in either; web-cli was out of credits so release tags unchecked. Non-RVV builds unaffected since the code is RISC-V assembly only.moreless

What the sources say, verbatim

365 characters

Sources and references

NVD: CVE-2026-125256Nov 9, 2026
Patch: github.comFix · github.com
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next Ffmpeg threat the day it hits your stack.

Start free

FFmpeg: narrow RGB video overflows heap on RISC-V Huffyuv encoding

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Ffmpeg threat the day it hits your stack.

FFmpeg: narrow RGB video overflows heap on RISC-V Huffyuv encoding

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Ffmpeg threat the day it hits your stack.