FFmpeg: Out-of-bounds memory access in huffyuvenc (CVE-2026-125229)

FFmpeg through version 9.0.2 contains an out-of-bounds memory access vulnerability in the encode_frame() function within libavcodec/huffyuvenc.c. The vulnerability exists because encode_init() fails to validate minimum frame dimensions when using the median predictor. An attacker can supply a specially crafted video file with undersized dimensions, such as frames that are 2 pixels wide or 1 to 2 pixels tall, which triggers negative sub_median_pred lengths and subsequent out-of-bounds memory operations during transcoding to huffyuv or ffvhuff.

Impact

Successful exploitation may result in an application crash, causing a denial of service for any process utilizing the vulnerable FFmpeg library for video transcoding. The nature of the out-of-bounds read and write operations also presents a risk of memory corruption.

Recommendation

• Audit systems for applications that utilize the FFmpeg library for video transcoding, particularly those that accept user-provided video files.
• Monitor for and apply updates to FFmpeg once a security patch addressing CVE-2026-125229 is released by the maintainers.
• Implement input validation on applications using FFmpeg to reject video files with dimensions below standard expected thresholds until the library can be updated.