UBUNTU-CVE-2026-125196: Buffer Overflow
FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapveencode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose resolution changes mid-stream so that transcoding to APV without rescaling writes attacker-controlled pixel data past the imgb plane buffers.
Affected Software
Event History
Frequently Asked Questions
Which workflows are exposed?
Workflows that transcode attacker-supplied video to APV are exposed when frames can be larger than the configured encoder dimensions. The described trigger is a video whose resolution changes during the stream.
What does an attacker need to provide?
An attacker needs to supply crafted video frames with dimensions exceeding those configured for the encoder. The frames can carry attacker-controlled pixel data that is written past the image-plane buffers during APV transcoding.
Is rescaling relevant as a temporary mitigation?
Yes. The overflow is described as occurring when transcoding to APV without rescaling, so ensuring input is rescaled to the configured encoder dimensions avoids the stated condition.
How can I determine whether a deployment may be affected?
Check whether the deployment uses FFmpeg through version 9.0.2 and performs APV transcoding. Systems that accept videos with mid-stream resolution changes without rescaling them to configured encoder dimensions match the described affected scenario.