Threats tagged 'ghsa-vm4w-xj5q-cxj8'

FFmpeg versions 8.0 through 9.0.2 have a memory leak vulnerability in the VP9 decoder. The issue arises because the function vp9_decode_frame() does not reset the CBS fragment on error paths, leading to memory exhaustion when processing crafted VP9 streams with invalid tile sizes using slice threading.