PT-2026-141095
CVE-2026-125267
·
Published
2026-11-09
·
Updated
2026-11-09
Description by
CVSS 3.1
7.8
HighMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstream index triggers an integer overflow, bypassing the reallocation check so memcpy() corrupts heap memory or crashes the application.
Found an issue in the description? Have something to add? Feel free to write us 👾