CVE-2026-125267: FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstreamindex triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using an affected FFmpeg version and decoding APAC files are exposed. Exploitation requires an attacker to provide a crafted APAC file that the application processes.
Does exploitation require authentication or user interaction?
The supplied vector indicates no privileges are required, but user interaction is required. The vulnerable processing occurs when the crafted APAC file is decoded.
What versions should be remediated?
Upgrade FFmpeg to 8.1.3 or later on the 8.x line, or 9.0.2 or later on the 9.x line. Versions before those releases are affected according to the advisory.
What happens if exploitation succeeds?
The crafted file can cause an integer overflow that bypasses a reallocation check, leading memcpy() to write outside the heap buffer. This can corrupt heap memory or crash the application, with high impacts to confidentiality, integrity, and availability.