Threats tagged 'ghsa-q3xq-h42f-cj6f'

FFmpeg versions through 9.0.2 have a heap buffer overflow vulnerability in the vdpau_hevc_start_frame() function of libavcodec/vdpau_hevc.c. This flaw occurs because the function copies unbounded PPS tile counts into fixed-size VDPAU arrays, allowing crafted HEVC bitstreams with excessive tile columns or rows to overwrite memory beyond allocated buffers. This can lead to memory corruption in applications using VDPAU decoding.