CVE-2026-125174 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's Hap video decoder mishandles a failed memory reallocation when a frame declares an oversized chunk count, leaving a NULL table that gets written to. An attacker who supplies a crafted Hap video file can crash the application that decodes it.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any application that decodes Hap-encoded video with FFmpeg's libavcodec, including media pipelines and transcoding services that accept user-supplied files. Systems that never decode Hap video or that use FFmpeg builds without the Hap decoder are not affected.
Not affected if ffmpeg-before-8.0-or-not-in-range, no-hap-decoding
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version, or the libavcodec version your application links against.8.1.3 for the 8.x line9.0.2 for the 9.x lineFFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer dereference vulnerability in ff_hap_set_chunk_count() in libavcodec/hap.c, where a shadowed return variable masks reallocation failures. Attackers can supply a crafted Hap video frame with an oversized chunk count so the decoder writes through a NULL chunk table, crashing the application.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.