Threats tagged 'ghsa-gxvj-hcfx-794p'

FFmpeg versions through 9.0.2 have a vulnerability in the parse_frame_header() function of libavcodec/jpegxl_parser.c. The flaw involves improper validation of TOC entry counts against remaining input, allowing crafted JPEG XL frame headers with manipulated TOC and large toc_count values to cause excessive looping and CPU exhaustion. This leads to an uncontrolled resource consumption denial-of-service condition.