Heap Buffer Overflow Vulnerability in FFmpeg by Video Encoding Routines

CVE-2026-125256

What is CVE-2026-125256?

FFmpeg versions up to 9.0.2 contain a vulnerability that can lead to heap buffer overflow through the ff_llvidenc_diff_bytes_rvv() function. This issue arises when attackers supply RGB video that is narrower than expected dimensions for Huffyuv transcoding on RVV-enabled RISC-V builds. By triggering negative length values, malicious users can write beyond the boundaries of the encoder's temporary buffer, potentially leading to memory corruption and exploitation of the affected application.

References