FFMPEG · CVE-2026-125196 · Runtime
NO FIX YET · SEE WHAT TO DO
FFmpeg through 9.0.2 has a heap buffer overflow in the liboapve encoder (libavcodec/liboapvenc.c) when frames are larger than the configured encoder dimensions. An attacker who supplies a video whose resolution changes mid-stream can corrupt heap memory while it is transcoded to APV without rescaling.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Systems that run FFmpeg built with the liboapve encoder and transcode untrusted video into APV without rescaling are exposed. Pipelines that only handle trusted media, or that do not use the APV encoder, can skip it. The sources do not give the fixed version range beyond 'through 9.0.2'.
Not affected if no-apv-encoding, no-liboapve, trusted-input-only
Who cares ffmpeg, liboapve, media-transcoding, self-hosted
9.0.2 are affectedFFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose resolution changes mid-stream so that transcoding to APV without rescaling writes attacker-controlled pixel data past the imgb plane buffers.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.