CVE-2026-125267
Received Received - Intake

Heap Out-of-Bounds Write in FFmpeg APAC Decoder

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: VulnCheck

Description
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-10
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125267
EUVD
EUVD-2026-120217

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
FFmpeg FFmpeg From 0 (inc) to 8.1.3 (exc)
FFmpeg FFmpeg From 9.0 (inc) to 9.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap out-of-bounds write flaw in FFmpeg versions before 8.1.3 and 9.x before 9.0.2. It occurs in the APAC decoder (libavcodec/apac.c) due to an unreset bitstream index. Attackers exploit this by providing a crafted APAC file that causes an integer overflow in bitstream_index, bypassing memory reallocation checks. This leads to memcpy() corrupting heap memory or crashing the application.

Detection Guidance

This vulnerability can be detected by checking the FFmpeg version in use. If your system runs FFmpeg versions before 8.1.3 or 9.x before 9.0.2, it is vulnerable. Use commands like 'ffmpeg -version' to check the installed version.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code, crash the application, or gain unauthorized access to system memory. Users processing untrusted APAC files with vulnerable FFmpeg versions are at risk of denial-of-service or potential remote code execution.

Compliance Impact

This vulnerability could potentially lead to unauthorized access or corruption of sensitive data processed by FFmpeg, which may impact compliance with GDPR (data integrity and confidentiality) and HIPAA (protected health information integrity).

Mitigation Strategies

Update FFmpeg to version 8.1.3, 9.0.2, or later to address the heap out-of-bounds write vulnerability in the APAC decoder.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125267. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...