CVE-2026-125256

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ff llvidenc diff bytes rvv() that allows attackers to corrupt heap memory by triggering negative length values in the Huffyuv encoder. Attackers can supply RGB video narrower than 8 or 16 pixels for huffyuv transcoding on RVV-enabled RISC-V builds, causing writes past the encoder's temp buffer.