UBUNTU-CVE-2026-125174: Null Pointer Dereference
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ffhapsetchunkcount() in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes through a NULL chunk table, crashing the application.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications on Ubuntu that use the affected FFmpeg decoder and process Hap video frames are exposed. The described impact is an application crash rather than loss of confidentiality or integrity.
What does an attacker need to exploit it?
An attacker needs to cause the application to decode a crafted Hap video frame with an oversized chunk count. The vector is local and requires user interaction, according to the supplied severity vector.
Are default deployments affected?
The provided data does not establish whether a default Ubuntu configuration decodes Hap video. Exposure depends on whether the application uses FFmpeg to process attacker-controlled Hap content.
What versions contain the flaw?
FFmpeg versions before 8.1.3 are affected, as are 9.x versions before 9.0.2.
What can be done before updating?
Avoid decoding untrusted Hap video frames, particularly content that may contain an oversized chunk count, until an updated FFmpeg version is available.