{"id":"CVE-2026-125196","kind":"vulnerability","aliases":["CVE-2026-125196"],"related":[],"title":"FFmpeg: crafted mid-stream resolution change overflows heap in APV encoder","description":"FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose resolution changes mid-stream so that transcoding to APV without rescaling writes attacker-controlled pixel data past the imgb plane buffers.","summary":"FFmpeg through 9.0.2 has a heap buffer overflow in the liboapve encoder (libavcodec/liboapvenc.c) when frames are larger than the configured encoder dimensions. An attacker who supplies a video whose resolution changes mid-stream can corrupt heap memory while it is transcoded to APV without rescaling.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":">= 8.0, <= 9.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ffmpeg","liboapve","media-transcoding","runtime","self-hosted"],"not_affected_if":["no-apv-encoding","no-liboapve","trusted-input-only"],"how_to_check":"Run ffmpeg -version; builds 8.0 through 9.0.2 are affected. Run ffmpeg -encoders | grep apv: without liboapve the path is absent. Look for services transcoding untrusted video to APV without a scale filter. Until a release is confirmed, check whether your source includes the commit.","fix":"No fixed release named in sources. Fix is upstream commit 87cdb6cd6a8d1ec201cb82b30e64d5f946939e23 (liboapvenc.c copies input using codec context dimensions); build from master with it or a release that includes it.","status":"open","published_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","triaged_at":"2026-11-09T19:30:13+00:00","updated_at":"2026-11-09T19:34:52+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-09T19:30:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FFmpeg: crafted mid-stream resolution change overflows heap in APV encoder","impact":"high","summary":"FFmpeg through 9.0.2 has a heap buffer overflow in the liboapve encoder (libavcodec/liboapvenc.c) when frames are larger than the configured encoder dimensions. An attacker who supplies a video whose resolution changes mid-stream can corrupt heap memory while it is transcoded to APV without rescaling.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-transcoding","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker corrupts heap memory, possibly running code on the server.","analyst_note":"Confirm the fixed FFmpeg version from the linked patch on github.com and the VulnCheck advisory; the sources only say 'through 9.0.2'.","how_to_check":"- Run `ffmpeg -version` and compare against the fixed release named in the sources.\n- Check whether your FFmpeg build includes liboapve (`ffmpeg -encoders | grep oapve`); without it the encoder path is not present.\n- Look for services that transcode user-uploaded video to APV.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-liboapve","trusted-input-only"],"who_is_affected":"Systems that run FFmpeg built with the liboapve encoder and transcode untrusted video into APV without rescaling are exposed. Pipelines that only handle trusted media, or that do not use the APV encoder, can skip it. The sources do not give the fixed version range beyond 'through 9.0.2'.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000793,"input_tokens":4652,"output_tokens":655,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed FFmpeg version from the linked patch on github.com and the VulnCheck advisory; the sources only say 'through 9.0.2'.","search":"'-125196':15A,18A '-2026':14A,17A '9.0.2':31B,77C 'allow':90C 'apv':11A,72B,119C 'attack':52B,91C,105C,124C 'attacker-control':123C 'buffer':35B,81C,132C 'chang':7A,59B,111C 'configur':48B,102C 'contain':78C 'control':125C 'corrupt':64B,93C 'craft':2A,107C 'cve':13A,16A 'data':127C 'dimens':50B,104C 'encod':12A,40B,49B,86C,103C 'ffmpeg':1A,19A,20B,29B,75C 'frame':43B,98C 'heap':9A,34B,65B,80C,94C 'host':28B 'imgb':130C 'larger':45B,99C 'libavcodec/liboapvenc.c':41B,88C 'liboapv':21B,39B,85C 'media':23B 'media-transcod':22B 'memori':66B,95C 'mid':4A,61B,113C 'mid-stream':3A,60B,112C 'overflow':8A,36B,82C 'past':128C 'pixel':126C 'plane':131C 'rescal':74B,121C 'resolut':6A,58B,110C 'runtim':25B 'self':27B 'self-host':26B 'stream':5A,62B,114C 'suppli':54B,97C 'transcod':24B,70B,117C 'video':56B,108C 'vulner':83C 'whose':57B,109C 'without':73B,120C 'write':122C","nicknames":[],"mitigations":[],"who_affected":"Systems that run FFmpeg built with the liboapve encoder and transcode untrusted video into APV without rescaling are exposed. Pipelines that only handle trusted media, or that do not use the APV encoder, can skip it. The sources do not give the fixed version range beyond 'through 9.0.2'.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["ffmpeg","high","liboapve","mediatranscoding","runtime","selfhosted"],"campaign_type":null,"search_a":"'-125196':15A,18A '-2026':14A,17A 'apv':11A 'chang':7A 'craft':2A 'cve':13A,16A 'encod':12A 'ffmpeg':1A,19A 'heap':9A 'mid':4A 'mid-stream':3A 'overflow':8A 'resolut':6A 'stream':5A","search_b":"'9.0.2':31B 'apv':72B 'attack':52B 'buffer':35B 'chang':59B 'configur':48B 'corrupt':64B 'dimens':50B 'encod':40B,49B 'ffmpeg':20B,29B 'frame':43B 'heap':34B,65B 'host':28B 'larger':45B 'libavcodec/liboapvenc.c':41B 'liboapv':21B,39B 'media':23B 'media-transcod':22B 'memori':66B 'mid':61B 'mid-stream':60B 'overflow':36B 'rescal':74B 'resolut':58B 'runtim':25B 'self':27B 'self-host':26B 'stream':62B 'suppli':54B 'transcod':24B,70B 'video':56B 'whose':57B 'without':73B","search_c":"'9.0.2':77C 'allow':90C 'apv':119C 'attack':91C,105C,124C 'attacker-control':123C 'buffer':81C,132C 'chang':111C 'configur':102C 'contain':78C 'control':125C 'corrupt':93C 'craft':107C 'data':127C 'dimens':104C 'encod':86C,103C 'ffmpeg':75C 'frame':98C 'heap':80C,94C 'imgb':130C 'larger':99C 'libavcodec/liboapvenc.c':88C 'liboapv':85C 'memori':95C 'mid':113C 'mid-stream':112C 'overflow':82C 'past':128C 'pixel':126C 'plane':131C 'rescal':121C 'resolut':110C 'stream':114C 'suppli':97C 'transcod':117C 'video':108C 'vulner':83C 'whose':109C 'without':120C 'write':122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125196","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125196","severity":null,"published_at":"2026-11-09T19:16:55+00:00","modified_at":"2026-11-09T19:16:55+00:00","first_seen_at":"2026-11-09T19:28:17+00:00","fetched_at":"2026-11-09T19:28:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125196:2333","url":null,"severity":null,"published_at":"2026-11-09T19:34:52+00:00","modified_at":"2026-11-09T19:34:52+00:00","first_seen_at":"2026-11-09T19:34:52+00:00","fetched_at":"2026-11-09T19:34:52+00:00","note":"Read commit 87cdb6cd and VulnCheck advisory (via WebFetch; web-cli out of credits). Affected FFmpeg >=8.0 through 9.0.2 per VulnCheck; no fixed release named, only the commit (encoder now copies using avctx dimensions). No exploitation or PoC stated. Release containing the fix unknown; check FFmpeg release notes/tags."}],"documents":[{"id":109283,"url":"https://github.com/FFmpeg/FFmpeg/commit/87cdb6cd6a8d1ec201cb82b30e64d5f946939e23","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109284,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-liboapv-apv-encoder-wrapper","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}