CVE-2026-125070

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqidecodeframe in libavcodec/eatqi.c, which ignores initgetbits failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial o...

EUVD-2026-120245

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqidecodeframe in libavcodec/eatqi.c, which ignores initgetbits failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing denial o...

PT-2026-140984

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi decode frame in libavcodec/eatqi.c, which ignores init get bits failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte payload to crash the process, causing deni...