{"id":"CVE-2026-125256","kind":"vulnerability","aliases":["CVE-2026-125256"],"related":[],"title":"FFmpeg: narrow RGB video overflows heap on RISC-V Huffyuv encoding","description":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer.","summary":"FFmpeg through 9.0.2 has a heap buffer overflow in the RISC-V vector (RVV) Huffyuv encoder routine ff_llvidenc_diff_bytes_rvv(). Supplying RGB video narrower than 8 or 16 pixels makes a negative length write past the encoder's temporary buffer, corrupting heap memory.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":">= 7.0, <= 9.0.2 (RISC-V RVV builds)","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","huffyuv","media-transcoding","package","risc-v","rvv"],"not_affected_if":["no-huffyuv-encoding","no-untrusted-media","non-risc-v-hosts","non-riscv","rvv-disabled"],"how_to_check":"Only RISC-V builds with RVV are affected (x86, ARM and other builds do not contain this code). Run 'ffmpeg -version' and check the configuration for a riscv target, and whether libavcodec/riscv/llvidencdsp_rvv.S is built in. Then check whether you encode untrusted video to Huffyuv (-c:v huffyuv), especially RGB input narrower than 16 pixels. Check that your source contains commit 1f7bdea.","fix":"No released version confirmed. Fixed in FFmpeg master by commit 1f7bdea654a8a9a1761759e22d83943371cff21f; build from a tree containing it or wait for a release newer than 9.0.2 that includes it.","status":"open","published_at":"2026-11-09T20:18:11+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","triaged_at":"2026-11-09T20:49:44+00:00","updated_at":"2026-11-09T20:51:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T20:49:44Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"FFmpeg: narrow RGB video overflows heap on RISC-V Huffyuv encoding","impact":"high","summary":"FFmpeg through 9.0.2 has a heap buffer overflow in the RISC-V vector (RVV) Huffyuv encoder routine ff_llvidenc_diff_bytes_rvv(). Supplying RGB video narrower than 8 or 16 pixels makes a negative length write past the encoder's temporary buffer, corrupting heap memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","risc-v","rvv","media-transcoding"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker corrupts heap memory, possibly running code in the FFmpeg process.","analyst_note":"Confirm the fixed FFmpeg version and the patch on github.com from the linked fix, and whether non-RVV builds are unaffected.","how_to_check":"- Check whether the FFmpeg build targets RISC-V with RVV enabled, for example with `ffmpeg -version` and the configure flags shown in its output.\n- Check whether the service transcodes untrusted video to Huffyuv (`-c:v huffyuv`) or accepts uploads that are converted this way.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["non-risc-v-hosts","no-huffyuv-encoding","no-untrusted-media"],"who_is_affected":"Only FFmpeg builds on RISC-V with RVV-enabled code paths reach the vulnerable routine, and it is triggered by encoding narrow RGB frames to Huffyuv. Services that transcode untrusted media on RISC-V hosts are the ones to look at; x86 and ARM builds are not described as affected by the sources. Teams that do not run FFmpeg on RISC-V can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000821,"input_tokens":4657,"output_tokens":711,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version and the patch on github.com from the linked fix, and whether non-RVV builds are unaffected.","search":"'-125256':15A,18A '-2026':14A,17A '16':60B,116C '8':58B,114C '9.0.2':32B,78C 'allow':92C 'attack':93C,107C 'buffer':36B,72B,82C,136C 'build':128C 'byte':51B,89C 'caus':129C 'contain':79C 'corrupt':73B,95C 'cve':13A,16A 'diff':50B,88C 'enabl':124C 'encod':12A,46B,69B,106C,133C 'ff':48B,86C 'ffmpeg':1A,19A,20B,30B,76C 'heap':6A,35B,74B,81C,96C 'huffyuv':11A,21B,45B,105C,119C 'length':65B,101C 'llvidenc':49B,87C 'make':62B 'media':23B 'media-transcod':22B 'memori':75B,97C 'narrow':2A,56B,112C 'negat':64B,100C 'overflow':5A,37B,83C 'packag':25B 'past':67B,131C 'pixel':61B,117C 'rgb':3A,54B,110C 'risc':9A,27B,41B,126C 'risc-v':8A,26B,40B,125C 'routin':47B 'rvv':29B,44B,52B,90C,123C 'rvv-enabl':122C 'suppli':53B,109C 'temp':135C 'temporari':71B 'transcod':24B,120C 'trigger':99C 'v':10A,28B,42B,127C 'valu':102C 'vector':43B 'video':4A,55B,111C 'vulner':84C 'write':66B,130C","nicknames":[],"mitigations":[],"who_affected":"FFmpeg 7.0 through 9.0.2 built for RISC-V with the vector extension (RVV) enabled, when it encodes RGB video to Huffyuv. A user-supplied very narrow video (under 8 or 16 pixels wide) causes a heap write past the temporary buffer. Everyone on x86, ARM or non-RVV builds, and anyone who never encodes to Huffyuv, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","huffyuv","mediatranscoding","package","riscv","rvv"],"campaign_type":null,"search_a":"'-125256':15A,18A '-2026':14A,17A 'cve':13A,16A 'encod':12A 'ffmpeg':1A,19A 'heap':6A 'huffyuv':11A 'narrow':2A 'overflow':5A 'rgb':3A 'risc':9A 'risc-v':8A 'v':10A 'video':4A","search_b":"'16':60B '8':58B '9.0.2':32B 'buffer':36B,72B 'byte':51B 'corrupt':73B 'diff':50B 'encod':46B,69B 'ff':48B 'ffmpeg':20B,30B 'heap':35B,74B 'huffyuv':21B,45B 'length':65B 'llvidenc':49B 'make':62B 'media':23B 'media-transcod':22B 'memori':75B 'narrow':56B 'negat':64B 'overflow':37B 'packag':25B 'past':67B 'pixel':61B 'rgb':54B 'risc':27B,41B 'risc-v':26B,40B 'routin':47B 'rvv':29B,44B,52B 'suppli':53B 'temporari':71B 'transcod':24B 'v':28B,42B 'vector':43B 'video':55B 'write':66B","search_c":"'16':116C '8':114C '9.0.2':78C 'allow':92C 'attack':93C,107C 'buffer':82C,136C 'build':128C 'byte':89C 'caus':129C 'contain':79C 'corrupt':95C 'diff':88C 'enabl':124C 'encod':106C,133C 'ff':86C 'ffmpeg':76C 'heap':81C,96C 'huffyuv':105C,119C 'length':101C 'llvidenc':87C 'memori':97C 'narrow':112C 'negat':100C 'overflow':83C 'past':131C 'pixel':117C 'rgb':110C 'risc':126C 'risc-v':125C 'rvv':90C,123C 'rvv-enabl':122C 'suppli':109C 'temp':135C 'transcod':120C 'trigger':99C 'v':127C 'valu':102C 'video':111C 'vulner':84C 'write':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125256","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125256","severity":null,"published_at":"2026-11-09T20:18:11+00:00","modified_at":"2026-11-09T20:18:11+00:00","first_seen_at":"2026-11-09T20:48:13+00:00","fetched_at":"2026-11-09T20:48:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125256:2347","url":null,"severity":null,"published_at":"2026-11-09T20:51:00+00:00","modified_at":"2026-11-09T20:51:00+00:00","first_seen_at":"2026-11-09T20:51:00+00:00","fetched_at":"2026-11-09T20:51:00+00:00","note":"Read FFmpeg commit 1f7bdea (only libavcodec/riscv/llvidencdsp_rvv.S changed: early return when length <= 0) and VulnCheck advisory (7.0 through 9.0.2). No fixed release named in either; web-cli was out of credits so release tags unchecked. Non-RVV builds unaffected since the code is RISC-V assembly only."}],"documents":[{"id":109723,"url":"https://github.com/FFmpeg/FFmpeg/commit/1f7bdea654a8a9a1761759e22d83943371cff21f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109724,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-risc-v-vector-diff-bytes-routine","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}