FFMPEG · CVE-2026-125104 · Runtime
NO FIX YET
FFmpeg's APE (Monkey's Audio) decoder fails to enforce the 73728-sample limit for legacy APE frames. A crafted file declaring a huge block count forces gigabyte-scale allocations and crashes the process.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg's decoder on untrusted media files, such as upload-processing or transcoding services. Sources do not list affected version ranges beyond 'through 9.0.2' or name a fixed release. Teams that never decode APE files from outside sources are less exposed.
Not affected if no-ape-decoding, no-untrusted-audio
Who cares ffmpeg, media-processing, transcoding
ffmpeg -version and compare against the fixed release in the sources.No fix yet, per the sources.
FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape_decode_frame() in libavcodec/apedec.c that fails to enforce the 73728-sample limit for legacy APE frames. Attackers can supply a crafted legacy Monkey's Audio file declaring an enormous nblocks value to force gigabyte-scale allocations and cause denial of service.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.