CVE Alert: CVE-2026-125196 – FFmpeg

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in liboapve_encode() in libavcodec/liboapvenc.c that allows attackers to corrupt heap memory by supplying frames larger than the configured encoder dimensions. Attackers can craft videos whose resolution changes mid-stream so that transcoding to APV without rescaling writes attacker-controlled pixel data past the imgb plane buffers.

**Risk verdict:** This is a high-impact risk for systems that encode untrusted media, but urgency cannot be placed confidently because exploitation and prevalence indicators were not provided.

**Why this matters:** Heap corruption can compromise the encoding process, potentially exposing data accessible to that process or enabling tampering and service disruption. A realistic route is a malicious media file entering a conversion workflow; impact depends on the process’s permissions and the sensitivity of its workload.

**Most likely attack path:** An attacker must get a crafted input processed by the vulnerable encoder, with particular stream characteristics making exploitation less straightforward. The attack is local, requires a condition to be present and user interaction, but no prior privileges; scope is unchanged, so direct lateral movement is not indicated, though a compromised service account could provide access to its resources.

**Who is most exposed:** Prioritise media platforms, editing or transcoding services, and automated upload pipelines that enable APV encoding. Exposure is lower where this encoder is absent or inputs are trusted and tightly controlled.

Identify processes invoking the APV encoder and correlate with unusual crashes or restarts.

Alert on heap-corruption diagnostics, sanitizer reports, or abnormal child-process exits.

Review upload and job logs for resolution-changing media submitted to APV workflows.

Mitigation and prioritisation

Apply the upstream fix promptly after compatibility testing; verify the deployed build includes it.

Until patched, disable APV encoding or block untrusted inputs from reaching that path.

Run conversion workers with minimal privileges, resource limits, and isolation.

If KEV inclusion is confirmed or EPSS reaches 0.5, treat as priority 1; those indicators were not supplied here.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.