---
id: "CVE-2026-125256"
page: "https://infrastack.ai/live/CVE-2026-125256"
kind: "vulnerability"
aliases: ["CVE-2026-125256"]
title: "FFmpeg: narrow RGB video overflows heap on RISC-V Huffyuv encoding"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ffmpeg", "fixed": [], "affected": ">= 7.0, <= 9.0.2 (RISC-V RVV builds)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ffmpeg", "huffyuv", "media-transcoding", "package", "risc-v", "rvv"]
not_affected_if: ["no-huffyuv-encoding", "no-untrusted-media", "non-risc-v-hosts", "non-riscv", "rvv-disabled"]
published_at: "2026-11-09T20:18:11+00:00"
first_seen_at: "2026-11-09T20:48:13+00:00"
updated_at: "2026-11-09T20:51:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125256", "first_seen_at": "2026-11-09T20:48:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T20:51:00+00:00"}]
exploit_sources: []
---

# FFmpeg: narrow RGB video overflows heap on RISC-V Huffyuv encoding

Link for people: https://infrastack.ai/live/CVE-2026-125256 (this .md is for agents)

FFmpeg through 9.0.2 has a heap buffer overflow in the RISC-V vector (RVV) Huffyuv encoder routine ff_llvidenc_diff_bytes_rvv(). Supplying RGB video narrower than 8 or 16 pixels makes a negative length write past the encoder's temporary buffer, corrupting heap memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ffmpeg affected >= 7.0, <= 9.0.2 (RISC-V RVV builds) fixed no fixed version listed

## How to check

Only RISC-V builds with RVV are affected (x86, ARM and other builds do not contain this code). Run 'ffmpeg -version' and check the configuration for a riscv target, and whether libavcodec/riscv/llvidencdsp_rvv.S is built in. Then check whether you encode untrusted video to Huffyuv (-c:v huffyuv), especially RGB input narrower than 16 pixels. Check that your source contains commit 1f7bdea.

## Fix

No released version confirmed. Fixed in FFmpeg master by commit 1f7bdea654a8a9a1761759e22d83943371cff21f; build from a tree containing it or wait for a release newer than 9.0.2 that includes it.

## Timeline

- 2026-11-09T20:48:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125256
- 2026-11-09T20:51:00+00:00 analyst — Read FFmpeg commit 1f7bdea (only libavcodec/riscv/llvidencdsp_rvv.S changed: early return when length <= 0) and VulnCheck advisory (7.0 through 9.0.2). No fixed release named in either; web-cli was out of credits so release tags unchecked. Non-RVV builds unaffected since the code is RISC-V assembly only.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-risc-v-vector-diff-bytes-routine
- [fix] Patch: github.com https://github.com/FFmpeg/FFmpeg/commit/1f7bdea654a8a9a1761759e22d83943371cff21f

## From the sources

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_