CVE-2026-125222: FFmpeg through 9.0.2 Heap Buffer Overflow via hap_parse_frame_header()

FFmpeg through 9.0.2 contains an integer overflow vulnerability in happarseframeheader() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap texsize, causing decompresschunksthread() to write outside texbuf and crash the application or potentially execute code.