CVE-2026-125238

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevdreceiveframe in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the avassert0 on...