Threats tagged 'ghsa-phr3-qwpx-974c'

FFmpeg versions through 9.0.2 have a use-after-free vulnerability in the MJPEG decoder component (libavcodec/mjpegdec.c). This flaw occurs when a crafted MJPEG stream contains a Start of Frame (SOF) marker without a preceding Start of Image (SOI) marker, leading to a freed buffer being accessed. The vulnerability can cause crashes or heap information leaks when the stale buffer pointer is passed to hardware acceleration decoders such as NVDEC.