CVE-2026-125229: FFmpeg through 9.0.2 Out-of-Bounds Memory Access in Huffyuv/FFVHUFF Median Predictor

Q: Which workflows are exposed to this issue?

Workflows that transcode attacker-controlled or otherwise unusually small video frames to the huffyuv or ffvhuff encoder are exposed. The vulnerable path is in FFmpeg's encoder, not merely in decoding or playback.

Q: What input is needed to trigger the vulnerability?

An attacker needs to cause transcoding of a tiny video frame using the median predictor, such as a frame that is 2 pixels wide or 1–2 pixels tall. User interaction is required according to the supplied vector.

Q: What is the likely impact of successful exploitation?

The malformed dimensions cause negative sub_median_pred lengths and out-of-bounds reads and writes in encode_frame(). This can crash the encoder; the provided severity vector also rates confidentiality, integrity, and availability impacts as high.

Q: What can be done while patching is unavailable?

Avoid transcoding untrusted tiny videos to huffyuv or ffvhuff, and reject or normalize frames that are 2 pixels wide or 1–2 pixels tall before they reach these encoders.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encodeframe() function of libavcodec/huffyuvenc.c, because encodeinit() never validates minimum frame dimensions for the median predictor. Attackers can supply a tiny video, such as a 2-pixel-wide or 1-2-pixel-tall frame, that causes negative submedianpred lengths and out-of-bounds reads and writes when transcoded to huffyuv or ffvhuff, crashing the encoder.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which workflows are exposed to this issue?

Workflows that transcode attacker-controlled or otherwise unusually small video frames to the huffyuv or ffvhuff encoder are exposed. The vulnerable path is in FFmpeg's encoder, not merely in decoding or playback.

What input is needed to trigger the vulnerability?

An attacker needs to cause transcoding of a tiny video frame using the median predictor, such as a frame that is 2 pixels wide or 1–2 pixels tall. User interaction is required according to the supplied vector.

What is the likely impact of successful exploitation?

The malformed dimensions cause negative sub_median_pred lengths and out-of-bounds reads and writes in encode_frame(). This can crash the encoder; the provided severity vector also rates confidentiality, integrity, and availability impacts as high.

What can be done while patching is unavailable?

Avoid transcoding untrusted tiny videos to huffyuv or ffvhuff, and reject or normalize frames that are 2 pixels wide or 1–2 pixels tall before they reach these encoders.

CVE-2026-125229: FFmpeg through 9.0.2 Out-of-Bounds Memory Access in Huffyuv/FFVHUFF Median Predictor

Affected Software

Event History

Frequently Asked Questions

Which workflows are exposed to this issue?

What input is needed to trigger the vulnerability?

What is the likely impact of successful exploitation?

What can be done while patching is unavailable?

Company

Resources

Contact

Frequently Asked Questions

Which workflows are exposed to this issue?

What input is needed to trigger the vulnerability?

What is the likely impact of successful exploitation?

What can be done while patching is unavailable?