CVE-2026-125196: FFmpeg through 9.0.2 Heap Buffer Overflow via liboapv APV Encoder Wrapper

Q: Which FFmpeg workflows are exposed?

Workflows that transcode attacker-supplied video to APV using the liboapv encoder are exposed when input frames can exceed the configured encoder dimensions. The described trigger is a video whose resolution changes mid-stream and is transcoded without rescaling.

Q: What must an attacker provide to trigger the issue?

An attacker needs to supply video input containing frames larger than the encoder's configured dimensions, such as a stream that changes resolution mid-stream. Exploitation requires the input to be processed by the affected APV encoding path.

Q: What can be done if updating is not immediately possible?

Avoid transcoding untrusted or resolution-changing inputs to APV without rescaling. Enforce expected frame dimensions or rescale frames to the configured encoder dimensions before they reach the APV encoder.

Q: How can I determine whether an environment is affected?

Check whether the deployed FFmpeg version is 9.0.2 or earlier and whether it uses liboapv APV encoding. Systems that accept untrusted video and allow frame sizes to change or exceed configured encoder dimensions are the relevant exposure cases.

Published Nov 9, 2026

Updated

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapveencode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose resolution changes mid-stream so that transcoding to APV without rescaling writes attacker-controlled pixel data past the imgb plane buffers.

Affected Software

1 affected component

FFmpeg FFmpeg<=9.0.2

Event History

Nov 9, 2026

CVE Published

via MITRE·07:11 PM

Data Sourced

via MITRE·07:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which FFmpeg workflows are exposed?

Workflows that transcode attacker-supplied video to APV using the liboapv encoder are exposed when input frames can exceed the configured encoder dimensions. The described trigger is a video whose resolution changes mid-stream and is transcoded without rescaling.

What must an attacker provide to trigger the issue?

An attacker needs to supply video input containing frames larger than the encoder's configured dimensions, such as a stream that changes resolution mid-stream. Exploitation requires the input to be processed by the affected APV encoding path.

What can be done if updating is not immediately possible?

Avoid transcoding untrusted or resolution-changing inputs to APV without rescaling. Enforce expected frame dimensions or rescale frames to the configured encoder dimensions before they reach the APV encoder.

How can I determine whether an environment is affected?

Check whether the deployed FFmpeg version is 9.0.2 or earlier and whether it uses liboapv APV encoding. Systems that accept untrusted video and allow frame sizes to change or exceed configured encoder dimensions are the relevant exposure cases.

CVE-2026-125196: FFmpeg through 9.0.2 Heap Buffer Overflow via liboapv APV Encoder Wrapper

Affected Software

Event History

Frequently Asked Questions

Which FFmpeg workflows are exposed?

What must an attacker provide to trigger the issue?

What can be done if updating is not immediately possible?

How can I determine whether an environment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which FFmpeg workflows are exposed?

What must an attacker provide to trigger the issue?

What can be done if updating is not immediately possible?

How can I determine whether an environment is affected?