CVE-2026-125267 · Package
NO FIX YET · SEE WHAT TO DO
FFmpeg's APAC audio decoder fails to reset a bitstream index, so a crafted APAC file can overflow an integer and write past a heap buffer. An attacker who gets a victim to open such a file can corrupt memory or crash the application.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any application or service that decodes untrusted APAC audio through FFmpeg's libavcodec is exposed, since the flaw is in the decoder itself. Systems that only process trusted local media, or that do not link FFmpeg's APAC decoder, are lower risk.
Not affected if apac-decoder-not-used, no-untrusted-input
Who cares ffmpeg, libavcodec, media-processing
ffmpeg -version and compare against the fixed versions below.ffmpeg -decoders | grep apac).8.1.3 or later on the 8.x line.9.0.2 or later on the 9.x line.FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.