Threats tagged 'ghsa-cpj2-27gm-mf52'

FFmpeg versions through 9.0.2 have an integer overflow vulnerability in the VVC decoder's alloc_frame() function on 32-bit builds. This flaw causes undersized allocation of the reference picture list, allowing crafted VVC (H.266) files with many NAL units per access unit to trigger heap out-of-bounds writes and memory corruption.