CVE-2026-125228

FFmpeg versions before 8.1.3 and 9.x before 9.0.2 are vulnerable to an out-of-bounds read in the put_vector() function within libavcodec/vorbisenc.c. The flaw occurs when NaN samples leave the codebook entry at -1. An attacker can supply audio containing NaN float samples to the native Vorbis enc...