EUVD-2026-120217

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds write vulnerability in the APAC decoder in libavcodec/apac.c caused by an unreset bitstream index. Attackers can supply a crafted APAC file whose growing bitstreamindex triggers an integer overflow, bypassing the reallocation...

CVE-2026-125267

FFmpeg versions before 8.1.3 and 9.x before 9.0.2 are susceptible to a heap out-of-bounds write vulnerability within the APAC decoder located in libavcodec/apac.c. The root cause is an unreset bitstream index ; an attacker can provide a crafted APAC file that causes the bitstream_index to grow an...