An integer overflow in hap_parse_frame_header() causes a heap buffer overflow on 32‑bit FFmpeg builds when the decoder processes specially crafted Hap video frames containing Snappy length prefixes. The overflow can overwrite nearby memory, potentially leading to a crash or, in the worst case, execution of arbitrary code on the host. The vulnerability is specifically tied to the integer wrap‑around that allows tex_size to exceed its bounds and is therefore a direct source of memory corruption.

FFmpeg libraries up to and including version 9.0.2, on 32‑bit architectures, are affected. All builds that enable Hap decoding in libavcodec/hapdec.c and have not been updated beyond 9.0.2 are vulnerable. 64‑bit builds are not impacted by this particular overflow.

The CVSS score of 7.3 indicates a high severity exploit scenario. While the EPSS value is not available, the combination of a buffer overflow that can lead to code execution, coupled with the absence of mandatory input validation, suggests a non‑negligible risk if an attacker can supply or influence Hap video streams. The vulnerability is not listed in the CISA KEV catalog, but the presence of a heap overflow and the potential for arbitrary code execution warrants close attention. Attackers would need to deliver malicious Hap frames, likely via media streams or files, to trigger the flaw.