# CVE-2026-125267

Heap out-of-bounds write in FFmpeg APAC decoder allowing crash or possible code execution

- Page: https://www.vulneraibility.com/cve/CVE-2026-125267
- CVSS: 8.5
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.14% (percentile 3.2)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-11-10)
- Weakness: CWE-190
- Published: 2026-11-09

## Affected versions

- FFmpeg: affected < 8.1.3; >= 9.0 and < 9.0.2

A version outside these ranges is not a statement that it is unaffected.

## Impact

Crafted APAC file triggers integer overflow and heap OOB write via memcpy; can crash processes or enable remote code execution via heap corruption.

## Action

Patch when possible

## Recommendation

Upgrade FFmpeg to >=8.1.3 or >=9.0.2; avoid processing untrusted APAC media.

## References

- [other] https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24432
- [patch] https://github.com/FFmpeg/FFmpeg/commit/e15ddb7f9a2f9b3ab8ac305efb6f94ddc18463d0
- [other] https://github.com/FFmpeg/FFmpeg/blob/n9.0.1/libavcodec/apac.c#L146
- [other] https://github.com/FFmpeg/FFmpeg
- [advisory] https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-and-9-x-before-9.0.2-heap-out-of-bounds-write-via-apac-decoder

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.