High severity7.0NVD Advisory· Published Nov 9, 2026
CVE-2026-125256
CVE-2026-125256
Description
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
4- code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25573nvd
- github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/riscv/llvidencdsp_rvv.Snvd
- github.com/FFmpeg/FFmpeg/commit/1f7bdea654a8a9a1761759e22d83943371cff21fnvd
- www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-risc-v-vector-diff-bytes-routinenvd
News mentions
0No linked articles in our index yet.