Threats tagged 'ghsa-j6vp-wxfx-cwv5'

A denial of service vulnerability exists in FFmpeg through version 9.0.2 in the libavcodec/vorbis_parser.c component. The flaw causes the parser to repeatedly re-parse invalid extradata for every packet when valid_extradata remains false. Maliciously crafted Ogg or Matroska Vorbis streams with large invalid extradata and many packets can exhaust CPU resources during demuxing or probing.