FFmpeg: Integer overflow in hap_parse_frame_header (CVE-2026-125222)

FFmpeg through version 9.0.2 is vulnerable to an integer overflow within the hap_parse_frame_header() function located in libavcodec/hapdec.c. This flaw occurs when processing maliciously crafted Hap video frames that contain Snappy length prefixes. On 32-bit builds, these prefixes can trigger an integer wrap-around on the tex_size variable, subsequently leading to a heap buffer overflow in decompress_chunks_thread(). An attacker could potentially leverage this condition to cause an application crash or achieve arbitrary code execution.

Impact

Successful exploitation may result in an application crash (Denial of Service) or arbitrary code execution within the context of the user running the FFmpeg-dependent application. The vulnerability specifically impacts 32-bit environments.

Recommendation

• Audit infrastructure to identify applications or services utilizing FFmpeg versions 9.0.2 or older.
• Prioritize patching or updating FFmpeg-dependent software to versions utilizing patched FFmpeg libraries once available from upstream or distribution maintainers.
• If immediate patching is not possible, implement strict input validation or sandboxing for untrusted video files processed by FFmpeg in 32-bit environments.