Threats tagged 'ghsa-c4j6-9j35-wgrc'

FFmpeg versions through 9.0.2 have a reachable assertion vulnerability in the libxevd_receive_frame() function within libavcodec/libxevd.c. This flaw occurs when the function returns success despite an access unit producing no frame, allowing crafted EVC files with truncated or picture-less access units to trigger an assertion failure (av_assert0) on frame->private_ref. This causes the decoding application to abort unexpectedly.