FFmpeg contains a heap buffer overflow in the liboapv APV encoder wrapper that allows an attacker to corrupt heap memory by supplying video frames larger than the configured encoder dimensions. This overflow occurs when transcoding frames without rescaling, causing attacker‑controlled pixel data to be written past the image plane buffers. The flaw is identified as a CWE‑122 and can lead to memory corruption, which may result in denial of service or, in worst‑case scenarios, arbitrary code execution if the corrupted state can be harnessed.

FFmpeg libraries version 9.0.2 and earlier with the liboapv APV encoder wrapper are affected. All systems that process media using these FFmpeg builds in transcoding pipelines are exposed regardless of operating system or platform.

The CVSS base score of 7.3 categorizes the vulnerability as high severity, though the EPSS score is not available and the CVE is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet. Attackers can exploit the flaw by crafting a video stream whose resolution changes mid‑stream; the transcoder then writes out‑of‑bounds data while processing oversized frames. The likely attack vector is an externally supplied media file or a compromised media source that the victim's system is compelled to process.