CVE-2026-125221

FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability in scoreheader in libavcodec/flacparser.c that allows attackers to exhaust the thread stack via crafted FLAC input. Attackers can supply a FLAC stream packed with many small valid-looking frame headers, forcing deep recursion...