CVE-2026-125267

FFmpeg versions before 8.1.3 and 9.x before 9.0.2 are susceptible to a heap out-of-bounds write vulnerability within the APAC decoder located in libavcodec/apac.c. The root cause is an unreset bitstream index ; an attacker can provide a crafted APAC file that causes the bitstream_index to grow an...