{"id":"CVE-2026-125267","kind":"vulnerability","aliases":["CVE-2026-125267"],"related":[],"title":"FFmpeg: crafted APAC audio file corrupts heap memory and crashes","description":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.","summary":"FFmpeg's APAC audio decoder fails to reset a bitstream index, so a crafted APAC file can overflow an integer and write past a heap buffer. An attacker who gets a victim to open such a file can corrupt memory or crash the application.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ffmpeg","libavcodec","media-processing","package"],"not_affected_if":["apac-decoder-not-used","no-untrusted-input"],"how_to_check":"- Run `ffmpeg -version` and compare against the fixed versions below.\n- Check whether your build includes the APAC decoder (`ffmpeg -decoders | grep apac`).","fix":"- FFmpeg `8.1.3` or later on the 8.x line.\n- FFmpeg `9.0.2` or later on the 9.x line.","status":"open","published_at":"2026-11-09T20:18:13+00:00","first_seen_at":"2026-11-09T20:48:14+00:00","triaged_at":"2026-11-09T20:49:39+00:00","updated_at":"2026-11-09T20:49:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T20:49:39Z","model":"claude-haiku-5-5","output":{"fix":"- FFmpeg `8.1.3` or later on the 8.x line.\n- FFmpeg `9.0.2` or later on the 9.x line.","reach":"unknown","title":"FFmpeg: crafted APAC audio file corrupts heap memory and crashes","impact":"high","summary":"FFmpeg's APAC audio decoder fails to reset a bitstream index, so a crafted APAC file can overflow an integer and write past a heap buffer. An attacker who gets a victim to open such a file can corrupt memory or crash the application.","audience":"developers","category":"package","nicknames":[],"who_cares":["ffmpeg","libavcodec","media-processing"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Heap memory corrupted or the host application crashes when decoding a crafted file.","analyst_note":"","how_to_check":"- Run `ffmpeg -version` and compare against the fixed versions below.\n- Check whether your build includes the APAC decoder (`ffmpeg -decoders | grep apac`).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-input","apac-decoder-not-used"],"who_is_affected":"Any application or service that decodes untrusted APAC audio through FFmpeg's libavcodec is exposed, since the flaw is in the decoder itself. Systems that only process trusted local media, or that do not link FFmpeg's APAC decoder, are lower risk.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4647,"output_tokens":553,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125267':13A,16A '-2026':12A,15A '8.1.3':69C '9':71C '9.0.2':74C 'apac':3A,25B,37B,86C,101C 'applic':66B,123C 'attack':50B,96C 'audio':4A,26B 'bitstream':32B,94C,105C 'bound':81C 'buffer':48B 'bypass':111C 'caus':90C 'check':114C 'contain':75C 'corrupt':6A,61B,117C 'craft':2A,36B,100C 'crash':10A,64B,121C 'cve':11A,14A 'decod':27B,87C 'fail':28B 'ffmpeg':1A,17B,23B,67C 'file':5A,38B,59B,102C 'get':52B 'grow':104C 'heap':7A,47B,77C,118C 'index':33B,95C,106C 'integ':42B,109C 'libavcodec':18B 'libavcodec/apac.c':89C 'media':20B 'media-process':19B 'memcpi':116C 'memori':8A,62B,119C 'open':56B 'out-of-bound':78C 'overflow':40B,110C 'packag':22B 'past':45B 'process':21B 'realloc':113C 'reset':30B 'suppli':98C 'trigger':107C 'unreset':93C 'victim':54B 'vulner':83C 'whose':103C 'write':44B,82C 'x':72C","nicknames":[],"mitigations":[],"who_affected":"Any application or service that decodes untrusted APAC audio through FFmpeg's libavcodec is exposed, since the flaw is in the decoder itself. Systems that only process trusted local media, or that do not link FFmpeg's APAC decoder, are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ffmpeg","high","libavcodec","mediaprocessing","package"],"campaign_type":null,"search_a":"'-125267':13A,16A '-2026':12A,15A 'apac':3A 'audio':4A 'corrupt':6A 'craft':2A 'crash':10A 'cve':11A,14A 'ffmpeg':1A 'file':5A 'heap':7A 'memori':8A","search_b":"'apac':25B,37B 'applic':66B 'attack':50B 'audio':26B 'bitstream':32B 'buffer':48B 'corrupt':61B 'craft':36B 'crash':64B 'decod':27B 'fail':28B 'ffmpeg':17B,23B 'file':38B,59B 'get':52B 'heap':47B 'index':33B 'integ':42B 'libavcodec':18B 'media':20B 'media-process':19B 'memori':62B 'open':56B 'overflow':40B 'packag':22B 'past':45B 'process':21B 'reset':30B 'victim':54B 'write':44B","search_c":"'8.1.3':69C '9':71C '9.0.2':74C 'apac':86C,101C 'applic':123C 'attack':96C 'bitstream':94C,105C 'bound':81C 'bypass':111C 'caus':90C 'check':114C 'contain':75C 'corrupt':117C 'craft':100C 'crash':121C 'decod':87C 'ffmpeg':67C 'file':102C 'grow':104C 'heap':77C,118C 'index':95C,106C 'integ':109C 'libavcodec/apac.c':89C 'memcpi':116C 'memori':119C 'out-of-bound':78C 'overflow':110C 'realloc':113C 'suppli':98C 'trigger':107C 'unreset':93C 'vulner':83C 'whose':103C 'write':82C 'x':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T20:18:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125267","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125267","severity":null,"published_at":"2026-11-09T20:18:13+00:00","modified_at":"2026-11-09T20:18:13+00:00","first_seen_at":"2026-11-09T20:48:14+00:00","fetched_at":"2026-11-09T20:48:14+00:00","note":null}],"documents":[{"id":109748,"url":"https://github.com/FFmpeg/FFmpeg/commit/e15ddb7f9a2f9b3ab8ac305efb6f94ddc18463d0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":109749,"url":"https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-heap-out-of-bounds-write-via-apac-decoder","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}