Threats tagged 'ghsa-jg49-h5w2-rr7x'

FFmpeg versions through 9.0.2 contain a double free vulnerability in the libavcodec/cbs_sei.c component. The flaw occurs because the function cbs_sei_delete_message() leaves a stale extension_data reference that is later reused by ff_cbs_sei_add_message(). This can be triggered by processing a crafted H.264 stream with a display orientation SEI message followed by payload extension data, leading to heap memory corruption.