Threats tagged 'ghsa-jhv5-xmvg-qh9f'

FFmpeg versions through 9.0.2 have an integer overflow vulnerability in the dng_decode_tiles() function. This flaw allows attackers to leak uninitialized memory by crafting DNG tile dimensions with TileWidth or TileLength values near INT_MAX. The vulnerability causes the tile processing loop to never execute, resulting in output frames that expose uninitialized or stale heap memory. The CVSS score is 3.3, indicating a low severity impact.