CVE-2026-125222

FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap parse frame header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex size, causing decompress chunks thread() to write outside tex buf and crash the application or potentially execute code.