Threats tagged 'ghsa-vff4-c9rw-vj7f'

FFmpeg versions through 9.0.2 have a memory leak vulnerability in the alloc_frame() function within libavcodec/vvc/refs.c. This flaw causes leaking of SPS and PPS references when frame buffer allocation fails. An attacker can exploit this by providing a crafted VVC (H.266) stream that repeatedly replaces parameter sets, leading to steadily increasing memory usage and potential denial of service.