Heap Out-of-Bounds Write in FFmpeg's APAC Decoder

CVE-2026-125267

What is CVE-2026-125267?

FFmpeg versions prior to 8.1.3 and the 9.x branch before 9.0.2 are susceptible to a heap out-of-bounds write vulnerability within the APAC decoder. An attacker can exploit this issue by providing a specially crafted APAC file. The flaw arises from an unreset bitstream index, which can lead to an integer overflow. This situation bypasses the critical reallocation check, resulting in memcpy() operations corrupting the heap memory, ultimately causing application crashes or unexpected behavior.

References