What is the fix for CVE-2026-125222?

No fixed release named yet (affected: through 9.0.2). The fix is upstream commit 62c308e0416bb701447817fe6f0bff074d206215, which rejects Hap frames whose summed chunk sizes would overflow INT_MAX. Build from master or backport that commit, or move to the first release that contains it once published.

Post Share

HIGH7.3CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

FFMPEG · CVE-2026-125222 · Runtime

FFmpeg: crafted Hap video frame overflows heap on 32-bit builds

Q: Who is not affected by CVE-2026-125222?

Not affected if: 64-bit-build, no-hap-decoding.

NO FIX YET · SEE WHAT TO DO

FFmpeg's Hap video decoder miscalculates buffer sizes from crafted Snappy length prefixes, so a malicious Hap file can overflow a heap buffer. An attacker gets a crash or possibly code execution when FFmpeg decodes the file.

first public Nov 9, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

FFmpeg builds through 9.0.2 on 32-bit systems are affected, according to the sources. Services that decode untrusted Hap video files, such as media converters or upload pipelines, are the systems to look at. 64-bit builds and teams that never decode Hap files can likely skip it, though the sources do not state this directly.

ffmpeg<= 9.0.2 (32-bit builds)

Not affected if 64-bit-build, no-hap-decoding

Who cares 32-bit, ffmpeg, media-processing

02 · How to check

Run ffmpeg -version: releases through 9.0.2 are listed as affected.
Check for a 32-bit build: file $(which ffmpeg) or ffmpeg -version configuration line (i386/armhf/x86 targets). The sources describe the overflow on 32-bit builds.
Check whether ffmpeg -decoders lists hap and whether untrusted video reaches it.
Also check any linked libavcodec (e.g. in other apps) for the same version and architecture.
To confirm a patch, look for the commit 62c308e in your source tree's libavcodec/hapdec.c.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 9, 2026

How it unfolded

2 events · Nov 9, 2026 → Nov 9, 2026

Nov 9, 202619:28 UTCNVD CVE-2026-125222
Nov 9, 202619:32 UTCInfraStack Analyst Read FFmpeg commit 62c308e (Niedermayer, 31 Oct 2026, 'avcodec/hap: bound the sum of the uncompressed chunk sizes'; found by ASAN in a 32-bit build, credit Joshua Rogers/AISLE) and the VulnCheck advisory. No fixed release is named in either source; the fix is the commit on master. Neither says 64-bit is safe; 64-bit skip is inferred from the commit's INT_MAX check and the 32-bit wording. No exploitation or PoC reported.moreless

What the sources say, verbatim

388 characters

FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex_size, causing decompress_chunks_thread() to write outside tex_buf and crash the application or potentially execute code.

Sources and references

NVD: CVE-2026-125222Nov 9, 2026
Patch: github.comFix · github.com
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com

This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Ffmpeg threat the day it hits your stack.

Start free

Post Share

HIGH7.3CVSS · disclosure@vulncheck.com

NO KNOWN
EXPLOIT

FFMPEG · CVE-2026-125222 · Runtime

FFmpeg: crafted Hap video frame overflows heap on 32-bit builds

NO FIX YET · SEE WHAT TO DO

first public Nov 9, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

ffmpeg<= 9.0.2 (32-bit builds)

Not affected if 64-bit-build, no-hap-decoding

Who cares 32-bit, ffmpeg, media-processing

02 · How to check

Run ffmpeg -version: releases through 9.0.2 are listed as affected.
Check for a 32-bit build: file $(which ffmpeg) or ffmpeg -version configuration line (i386/armhf/x86 targets). The sources describe the overflow on 32-bit builds.
Check whether ffmpeg -decoders lists hap and whether untrusted video reaches it.
Also check any linked libavcodec (e.g. in other apps) for the same version and architecture.
To confirm a patch, look for the commit 62c308e in your source tree's libavcodec/hapdec.c.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 9, 2026

How it unfolded

2 events · Nov 9, 2026 → Nov 9, 2026

Nov 9, 202619:28 UTCNVD CVE-2026-125222
Nov 9, 202619:32 UTCInfraStack Analyst Read FFmpeg commit 62c308e (Niedermayer, 31 Oct 2026, 'avcodec/hap: bound the sum of the uncompressed chunk sizes'; found by ASAN in a 32-bit build, credit Joshua Rogers/AISLE) and the VulnCheck advisory. No fixed release is named in either source; the fix is the commit on master. Neither says 64-bit is safe; 64-bit skip is inferred from the commit's INT_MAX check and the 32-bit wording. No exploitation or PoC reported.moreless

What the sources say, verbatim

388 characters

Sources and references

NVD: CVE-2026-125222Nov 9, 2026
Patch: github.comFix · github.com
Third-party advisory: www.vulncheck.comAdvisory · vulncheck.com

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Ffmpeg threat the day it hits your stack.

Start free

FFmpeg: crafted Hap video frame overflows heap on 32-bit builds

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Ffmpeg threat the day it hits your stack.

FFmpeg: crafted Hap video frame overflows heap on 32-bit builds

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Ffmpeg threat the day it hits your stack.

03 · The fix