Threats tagged 'ghsa-j9qm-j248-h26f'

FFmpeg versions through 9.0.2 have a heap buffer overflow vulnerability in the vaapi_hevc_start_frame() function within libavcodec/vaapi_hevc.c. This flaw occurs because the function copies unbounded PPS tile counts into fixed-size arrays, allowing crafted HEVC bitstreams with large pictures and many tiles to corrupt memory during decoding with VAAPI.