CVE-2026-125229

EUVD-2026-120179

09.11.2026, 19:17

FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encode_frame() function of libavcodec/huffyuvenc.c, because encode_init() never validates minimum frame dimensions for the median predictor. Attackers can supply a tiny video, such as a 2-pixel-wide or 1-2-pixel-tall frame, that causes negative sub_median_pred lengths and out-of-bounds reads and writes when transcoded to huffyuv or ffvhuff, crashing the encoder.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
VulnCheck	CNA	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
ffmpeg	ffmpeg	𝑥 ≤ 9.0.2	CNA

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25573

https://github.com/FFmpeg/FFmpeg

https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvenc.c#L762

https://github.com/FFmpeg/FFmpeg/commit/45f98d0819efe2b7ce93e9034b7e6a4ed6700621

https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-memory-access-in-huffyuv-ffvhuff-median-predictor