FFmpeg through 9.0.2 Heap Buffer Overflow via RISC-V Vector diff_bytes Routine
- Exploited
- No known exploitation
- Fix
- Fix or patch referenced
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects RVV-enabled RISC-V builds Huffyuv encoding of RGB video narrower than 8 or 16 pixels (transcoding)
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 12/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FFmpeg through 9.0.2 on RISC-V builds with RVV enabled has a heap buffer overflow in its Huffyuv encoder that an attacker can reach locally, without logging in, if a user is tricked into transcoding a crafted RGB video narrower than 8 or 16 pixels. Successful exploitation can corrupt heap memory.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff_llvidenc_diff_bytes_rvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.3/10CVSS 7.3
- No patch0/5No signal
What would change the score
- Would score about 62 if added to CISA KEV
- Would score about 57 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Affects RVV-enabled RISC-V builds Huffyuv encoding of RGB video narrower than 8 or 16 pixels (transcoding)Apply the patch listed under Evidence.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- FFmpeg FFmpeg
From 7.0 · through 9.0.2
Evidence 5
- Patch
- Report
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-125256
Is CVE-2026-125256 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A heap buffer overflow in FFmpeg's Huffyuv encoder lets attackers corrupt heap memory. It is triggered by negative length values, which cause out-of-bounds writes.Source: vulncheck.com
Which versions are affected by CVE-2026-125256?
FFmpeg: from 7.0 through 9.0.2.Source: cve.now feed data
Am I affected, and how do I check?
Versions from 7.0 through 9.0.2 are listed as affected, and the bug applies to RVV-enabled RISC-V builds. It is triggered during Huffyuv encoding of RGB video narrower than 8 or 16 pixels, such as during transcoding. To check, look at the FFmpeg version with ffmpeg -version and whether the build targets RISC-V with the RVV extension.Source: vulncheck.com
How do I fix CVE-2026-125256?
No fixed version is listed in the checked facts, so no specific upgrade target can be given. Check the FFmpeg project's advisories for a patched release.Source: vulncheck.com