UBUNTU-CVE-2026-125229: High severity ubuntu/ffmpeg vulnerability
FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encodeframe() function of libavcodec/huffyuvenc.c, because encodeinit() never validates minimum frame dimensions for the median predictor. Attackers can supply a tiny video, such as a 2-pixel-wide or 1-2-pixel-tall frame, that causes negative submedianpred lengths and out-of-bounds reads and writes when transcoded to huffyuv or ffvhuff, crashing the encoder.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using Ubuntu's FFmpeg package are exposed when they transcode attacker-controlled video to the huffyuv or ffvhuff encoder. The issue is locally exploitable according to the supplied vector, but no privileges are required and user interaction is required.
What input is needed to trigger the vulnerability?
An attacker needs to supply a video with very small frame dimensions for transcoding, such as a frame 2 pixels wide or 1–2 pixels tall. These dimensions can produce negative median-predictor lengths during encoding.
What happens when exploitation succeeds?
The encoder performs out-of-bounds reads and writes in the affected Huffyuv encoding path, which can crash the encoder. The supplied severity vector rates confidentiality, integrity, and availability impact as high.