CVE-2026-125172

FFmpeg versions through 9.0.2 are vulnerable to an out-of-bounds read in the libxevd_receive_frame() function located in libavcodec/libxevd.c. The root cause is a failure to validate NAL unit length prefixes against the actual remaining packet data. By providing crafted EVC media with oversized 4...