Threats tagged 'ghsa-j96v-29vh-9jrj'

FFmpeg versions through 9.0.2 have an uninitialized memory disclosure vulnerability in the CineForm HD decoder. This flaw allows attackers to leak heap memory by supplying a crafted CFHD file with an ImageHeight tag that exceeds coded band heights, causing uninitialized heap bytes to be included in the decoded video output. The vulnerability has a low severity rating and does not impact integrity or availability.