Bug 2570131 (CVE-2026-125256)
| Summary: | CVE-2026-125256 ffmpeg: ffmpeg: Arbitrary code execution via heap buffer overflow in Huffyuv encoder | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | bbrownin |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in FFmpeg. An attacker could exploit this vulnerability by submitting specially crafted video input with unusually narrow dimensions for transcoding using the Huffyuv video encoder on systems with RISC-V Vector (RVV) extensions enabled. Due to improper buffer length calculations, this triggers a heap-based buffer overflow by writing past the allocated memory buffer. This issue can lead to arbitrary code execution, memory corruption, or an application crash causing a Denial of Service (DoS).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-10 19:38:17 UTC
|