{"id":"CVE-2026-125222","kind":"vulnerability","aliases":["CVE-2026-125222"],"related":[],"title":"FFmpeg: crafted Hap video frame overflows heap on 32-bit builds","description":"FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex_size, causing decompress_chunks_thread() to write outside tex_buf and crash the application or potentially execute code.","summary":"FFmpeg's Hap video decoder miscalculates buffer sizes from crafted Snappy length prefixes, so a malicious Hap file can overflow a heap buffer. An attacker gets a crash or possibly code execution when FFmpeg decodes the file.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ffmpeg","fixed":[],"affected":"<= 9.0.2 (32-bit builds)","ecosystem":"vendor"}],"ecosystems":[],"tags":["32-bit","ffmpeg","media-processing","runtime"],"not_affected_if":["64-bit-build","no-hap-decoding"],"how_to_check":"- Run `ffmpeg -version`: releases through 9.0.2 are listed as affected.\n- Check for a 32-bit build: `file $(which ffmpeg)` or `ffmpeg -version` configuration line (i386/armhf/x86 targets). The sources describe the overflow on 32-bit builds.\n- Check whether `ffmpeg -decoders` lists `hap` and whether untrusted video reaches it.\n- Also check any linked libavcodec (e.g. in other apps) for the same version and architecture.\n- To confirm a patch, look for the commit 62c308e in your source tree's libavcodec/hapdec.c.","fix":"No fixed release named yet (affected: through 9.0.2). The fix is upstream commit 62c308e0416bb701447817fe6f0bff074d206215, which rejects Hap frames whose summed chunk sizes would overflow INT_MAX. Build from master or backport that commit, or move to the first release that contains it once published.","status":"open","published_at":"2026-11-09T19:16:59+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","triaged_at":"2026-11-09T19:29:59+00:00","updated_at":"2026-11-09T19:32:38+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-09T19:29:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"FFmpeg: crafted Hap video frame overflows heap on 32-bit builds","impact":"high","summary":"FFmpeg's Hap video decoder miscalculates buffer sizes from crafted Snappy length prefixes, so a malicious Hap file can overflow a heap buffer. An attacker gets a crash or possibly code execution when FFmpeg decodes the file.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["ffmpeg","media-processing","32-bit"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Crash or code execution when decoding a crafted Hap file","analyst_note":"Find the fixed FFmpeg version and patch commit from the linked GitHub fix and the VulnCheck advisory, and confirm the 32-bit-only scope.","how_to_check":"- Check the FFmpeg version with `ffmpeg -version`; the sources say the flaw covers releases through `9.0.2`.\n- Check whether the build is 32-bit, since the sources say the overflow affects 32-bit builds.\n- Check whether the Hap decoder is used on untrusted video input.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["64-bit-build","no-hap-decoding"],"who_is_affected":"FFmpeg builds through 9.0.2 on 32-bit systems are affected, according to the sources. Services that decode untrusted Hap video files, such as media converters or upload pipelines, are the systems to look at. 64-bit builds and teams that never decode Hap files can likely skip it, though the sources do not state this directly.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000783,"input_tokens":4649,"output_tokens":636,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed FFmpeg version and patch commit from the linked GitHub fix and the VulnCheck advisory, and confirm the 32-bit-only scope.","search":"'-125222':14A,17A '-2026':13A,16A '32':9A,19B,88C '9.0.2':65C 'allow':79C 'applic':117C 'attack':50B,80C,91C 'bit':10A,20B,89C 'buf':113C 'buffer':32B,48B,85C 'build':11A,90C 'caus':105C 'chunk':107C 'code':56B,121C 'contain':66C 'craft':2A,35B,93C 'crash':53B,115C 'cve':12A,15A 'decod':30B,60B 'decompress':106C 'execut':57B,120C 'ffmpeg':1A,18A,21B,26B,59B,63C 'file':43B,62B 'frame':5A,74C,96C 'get':51B 'hap':3A,28B,42B,72C,94C 'header':75C 'heap':7A,47B,84C 'integ':68C 'length':37B,99C 'libavcodec/hapdec.c':77C 'malici':41B 'media':23B 'media-process':22B 'miscalcul':31B 'outsid':111C 'overflow':6A,45B,69C,86C 'pars':73C 'possibl':55B 'potenti':119C 'prefix':38B,100C 'process':24B 'runtim':25B 'size':33B,104C 'snappi':36B,98C 'tex':103C,112C 'thread':108C 'trigger':82C 'video':4A,29B,95C 'vulner':70C 'wrap':102C 'write':110C","nicknames":[],"mitigations":[],"who_affected":"FFmpeg builds through 9.0.2 on 32-bit systems are affected, according to the sources. Services that decode untrusted Hap video files, such as media converters or upload pipelines, are the systems to look at. 64-bit builds and teams that never decode Hap files can likely skip it, though the sources do not state this directly.","tier":"B","verified":{"fix":{"at":"2026-11-09T19:32:38Z","by":"analyst","doc":"https://github.com/FFmpeg/FFmpeg/commit/62c308e0416bb701447817fe6f0bff074d206215","run_id":2325}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ffmpeg"],"ptokens":["ffmpeg"],"labels":["32bit","ffmpeg","high","mediaprocessing","runtime"],"campaign_type":null,"search_a":"'-125222':14A,17A '-2026':13A,16A '32':9A 'bit':10A 'build':11A 'craft':2A 'cve':12A,15A 'ffmpeg':1A,18A 'frame':5A 'hap':3A 'heap':7A 'overflow':6A 'video':4A","search_b":"'32':19B 'attack':50B 'bit':20B 'buffer':32B,48B 'code':56B 'craft':35B 'crash':53B 'decod':30B,60B 'execut':57B 'ffmpeg':21B,26B,59B 'file':43B,62B 'get':51B 'hap':28B,42B 'heap':47B 'length':37B 'malici':41B 'media':23B 'media-process':22B 'miscalcul':31B 'overflow':45B 'possibl':55B 'prefix':38B 'process':24B 'runtim':25B 'size':33B 'snappi':36B 'video':29B","search_c":"'32':88C '9.0.2':65C 'allow':79C 'applic':117C 'attack':80C,91C 'bit':89C 'buf':113C 'buffer':85C 'build':90C 'caus':105C 'chunk':107C 'code':121C 'contain':66C 'craft':93C 'crash':115C 'decompress':106C 'execut':120C 'ffmpeg':63C 'frame':74C,96C 'hap':72C,94C 'header':75C 'heap':84C 'integ':68C 'length':99C 'libavcodec/hapdec.c':77C 'outsid':111C 'overflow':69C,86C 'pars':73C 'potenti':119C 'prefix':100C 'size':104C 'snappi':98C 'tex':103C,112C 'thread':108C 'trigger':82C 'video':95C 'vulner':70C 'wrap':102C 'write':110C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125222","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125222","severity":null,"published_at":"2026-11-09T19:16:59+00:00","modified_at":"2026-11-09T19:16:59+00:00","first_seen_at":"2026-11-09T19:28:19+00:00","fetched_at":"2026-11-09T19:28:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125222:2325","url":null,"severity":null,"published_at":"2026-11-09T19:32:38+00:00","modified_at":"2026-11-09T19:32:38+00:00","first_seen_at":"2026-11-09T19:32:38+00:00","fetched_at":"2026-11-09T19:32:38+00:00","note":"Read FFmpeg commit 62c308e (Niedermayer, 31 Oct 2026, 'avcodec/hap: bound the sum of the uncompressed chunk sizes'; found by ASAN in a 32-bit build, credit Joshua Rogers/AISLE) and the VulnCheck advisory. No fixed release is named in either source; the fix is the commit on master. Neither says 64-bit is safe; 64-bit skip is inferred from the commit's INT_MAX check and the 32-bit wording. No exploitation or PoC reported."}],"documents":[{"id":109334,"url":"https://github.com/FFmpeg/FFmpeg/commit/62c308e0416bb701447817fe6f0bff074d206215","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109335,"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-heap-buffer-overflow-via-hap-parse-frame-header","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}