Threats tagged 'ghsa-fcxc-3rc8-vgxj'

An out-of-bounds read vulnerability exists in FFmpeg versions before 8.1.3 and 9.x before 9.0.2 in the put_vector() function of libavcodec/vorbisenc.c. This flaw occurs when NaN float samples cause the codebook entry to be -1, leading to heap reads before arrays. Attackers can exploit this by supplying crafted audio with NaN samples to the native Vorbis encoder, potentially causing application crashes or leaking adjacent heap memory into output.