Out-of-Bounds Memory Access in FFmpeg Huffyuv Encoder

CVE-2026-125229

What is CVE-2026-125229?

FFmpeg, in all versions up to 9.0.2, contains an out-of-bounds memory access vulnerability in the encode_frame() function of libavcodec/huffyuvenc.c. This occurs due to encode_init() failing to validate minimum frame dimensions for the median predictor. As a result, attackers can exploit this vulnerability by providing a small video frame, potentially as small as 2 pixels wide or 1-2 pixels tall. This can lead to negative sub_median_pred lengths, resulting in out-of-bounds reads and writes during the encoding process. Such exploitation may lead to crashes of the encoder, impacting system stability and security.

References