CVE-2026-125256: FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff_bytes Routine

Q: Which systems are exposed to this issue?

The vulnerable routine is specific to RVV-enabled RISC-V FFmpeg builds. The issue is triggered during Huffyuv transcoding of RGB video.

Q: What input is required to trigger the overflow?

An attacker needs to cause FFmpeg to transcode RGB video whose width is narrower than 8 or 16 pixels using the Huffyuv encoder. Those widths can produce negative length values and writes beyond the encoder temporary buffer.

Q: Does the provided information identify a workaround when patching is delayed?

Avoid Huffyuv transcoding of RGB inputs narrower than 8 or 16 pixels on RVV-enabled RISC-V builds. The provided data does not describe other mitigations.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ffllvidencdiffbytesrvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:12 PM

Data Sourced

via MITRE·07:12 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are exposed to this issue?

The vulnerable routine is specific to RVV-enabled RISC-V FFmpeg builds. The issue is triggered during Huffyuv transcoding of RGB video.

What input is required to trigger the overflow?

An attacker needs to cause FFmpeg to transcode RGB video whose width is narrower than 8 or 16 pixels using the Huffyuv encoder. Those widths can produce negative length values and writes beyond the encoder temporary buffer.

Does the provided information identify a workaround when patching is delayed?

Avoid Huffyuv transcoding of RGB inputs narrower than 8 or 16 pixels on RVV-enabled RISC-V builds. The provided data does not describe other mitigations.

CVE-2026-125256: FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff_bytes Routine

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What input is required to trigger the overflow?

Does the provided information identify a workaround when patching is delayed?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What input is required to trigger the overflow?

Does the provided information identify a workaround when patching is delayed?