CVE-2026-125267— FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder
Quick assessment
Affected
FFmpeg FFmpeg
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FFmpeg 8.1.3 之前版本以及 9.x 系列中 9.0.2 之前的版本，在 libavcodec/apac.c 的 APAC 解码器中存在堆越界写入漏洞。该漏洞由未重置的比特流索引（bitstream_index）引发。攻击者可构造特殊的 APAC 文件，使其中的 bitstream_index 不断增长并触发整数溢出，从而绕过重新分配检查，导致 memcpy() 函数破坏堆内存或致使应用程序崩溃。
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1499 · Endpoint Denial of Service T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-125267
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Out-of-Bounds Write via APAC Decoder
Source: CVE Program / CVE List V5
Vulnerability Description
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream_index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-125267
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-125267
请登录查看更多情报信息。
Other References for CVE-2026-125267 (4)
-
https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/apac.c#L146 technical-description
-
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24432 issue-tracking
Same Patch Batch · FFmpeg · 2026-11-09 · 121 CVEs total
| CVE-2026-125233 | 7.8 HIGH | FFmpeg through 9.0.2 Heap Buffer Overflow via DVB Subtitle Encoder |
| CVE-2026-125209 | 7.8 HIGH | FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow via dvdsubenc.c |
| CVE-2026-125250 | 7.8 HIGH | FFmpeg through 9.0.2 GIF Encoder Heap Buffer Overflow via shrunk_buf Remap |
| CVE-2026-125262 | 7.8 HIGH | FFmpeg through 9.0.2 Heap Buffer Overflow via LCEVC Enhancement Decoding |
| CVE-2026-125203 | 7.8 HIGH | FFmpeg before 8.1.3 and 9.x before 9.0.2 Heap Buffer Overflow in Cook Multichannel Decoder |
| CVE-2026-125259 | 7.8 HIGH | FFmpeg through 9.0.2 Heap Buffer Overflow via ProRes prores_ks Encoder |
| CVE-2026-125229 | 7.8 HIGH | FFmpeg through 9.0.2 Out-of-Bounds Memory Access in Huffyuv/FFVHUFF Median Predictor |
| CVE-2026-125244 | 7.8 HIGH | FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_poin |
| CVE-2026-125212 | 7.0 HIGH | FFmpeg through 9.0.2 Heap Buffer Overflow via VideoToolbox Encoder |
| CVE-2026-125211 | 7.0 HIGH | FFmpeg through 9.0.2 Heap Corruption via libaribcaption ASS Error Cleanup |
| CVE-2026-125219 | 7.0 HIGH | FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VDPAU Tile Arrays |
| CVE-2026-125218 | 7.0 HIGH | FFmpeg through 9.0.2 APNG Encoder Heap Buffer Overflow via encode_apng() |
| CVE-2026-125235 | 7.0 HIGH | FFmpeg through 9.0.2 Heap Overflow via QSV Encoder submit_frame() |
| CVE-2026-125257 | 7.0 HIGH | FFmpeg through 9.0.2 Heap Overflow via Nellymoser Encoder Trellis Search |
| CVE-2026-125248 | 7.0 HIGH | FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan Encoder Remap Buffer |
| CVE-2026-125213 | 7.0 HIGH | FFmpeg through 9.0.2 Heap Buffer Overflow via PSD Decoder RLE Path |
| CVE-2026-125202 | 7.0 HIGH | FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC VAAPI Tile Arrays |
| CVE-2026-125241 | 7.0 HIGH | FFmpeg through 9.0.2 Heap Buffer Overflow via FLIC Decoder check_pixel_ptr |
| CVE-2026-125239 | 7.0 HIGH | FFmpeg through 9.0.2 Heap Buffer Overflow via HEVC DXVA Tile Parameters |
| CVE-2026-125196 | 7.0 HIGH | FFmpeg through 9.0.2 Heap Buffer Overflow via liboapv APV Encoder Wrapper |
Showing top 20 of 121 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: FFmpeg
-
CVE-2026-125269
FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message -
CVE-2026-125270
FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Enc -
CVE-2026-125268
FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in -
CVE-2026-125266
FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure v -
CVE-2026-125265
FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstrea
Same vendor: FFmpeg
-
CVE-2026-125269
FFmpeg through 9.0.2 Double Free via cbs_sei_delete_message -
CVE-2026-125270
FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Enc -
CVE-2026-125268
FFmpeg through 9.0.2 Uninitialized Heap Memory Disclosure in -
CVE-2026-125265
FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstrea -
CVE-2026-125266
FFmpeg through 9.0.2 Uninitialized Stack Memory Disclosure v
Same weakness: CWE-190
-
CVE-2026-125259
FFmpeg through 9.0.2 Heap Buffer Overflow via ProRes prores_ -
CVE-2026-125253
FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out -
CVE-2026-125251
FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write vi -
CVE-2026-125249
FFmpeg 7.1 through 9.0.2 Heap Out-of-Bounds Write via Vulkan -
CVE-2026-125248
FFmpeg 9.0 through 9.0.2 Integer Overflow via FFV1 Vulkan En