CVE-2026-125269

FFmpeg versions through 9.0.2 are susceptible to a double free vulnerability within the libavcodec/cbs_sei.c component. The root cause is that the cbs_sei_delete_message() function leaves a stale extension_data reference, which is subsequently reused by ff_cbs_sei_add_message(). An attacker can t...