vvdecapp Decoder Heap Buffer Overflow DoS

The vulnerability of the createSubPicRefBufs function in the vvdecapp VVdeC decoder lies in the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

vvdecapp readAlf Heap Buffer Overflow DoS

The vulnerability of the readAlf function in the vvdecapp VVdeC decoder lies in the use of memory after it is freed during the processing of specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

vvdecapp decoder reconstructCoeff Heap Buffer Overflow DoS

The vulnerability of the reconstructCoeff function in the vvdecapp VVdeC decoder is related to the use of memory after deallocation when processing specially created VVC streams. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

CVE-2026-125254

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ffvvcslicerpl fails to validate numrefidxactive against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ffvvcmvscale,...

CVE-2026-125251

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder allocframe function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC H.266 file with a very large number of NAL units per access un...

CVE-2026-125244

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's shentrypoints function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC H.266 bitstream whose SPS/PPS tile and WPP layout produces excess entry points, overflowing...

CVE-2026-125236

FFmpeg through 9.0.2 contains a memory leak vulnerability in allocframe in libavcodec/vvc/refs.c that leaks SPS and PPS references when frame buffer allocation fails. Attackers can supply a crafted VVC H.266 stream that repeatedly replaces parameter sets, steadily growing memory use and causing...

CVE-2026-125185

FFmpeg through 9.0.2 contains a division by zero vulnerability in ffaomparsefilmgrainsets that fails to reject AFGS1 scaling points with repeated x values. Attackers can supply crafted HEVC or VVC files with zero-increment scaling points in T.35 SEI messages, causing generatescaling to divide by...

CVE-2026-125263 FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...

CVE-2026-125263 FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...

EUVD-2026-120213

FFmpeg 9.0 through 9.0.2 built with liblcevcdec fails to validate LCEVC enhanced output dimensions against maxpixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized getbuffer2 allocations a...

CVE-2026-125263

FFmpeg versions 9.0 through 9.0.2 built with liblcevc_dec are vulnerable to a memory exhaustion issue located in libavcodec/decode.c. The root cause is a failure to validate LCEVC enhanced output dimensions against max_pixels prior to frame allocation. An attacker can provide crafted H.264, HEVC,...

EUVD-2026-120204

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ffvvcslicerpl fails to validate numrefidxactive against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ffvvcmvscale,...

CVE-2026-125254 FFmpeg through 9.0.2 Division by Zero via VVC ff_vvc_slice_rpl()

FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ffvvcslicerpl fails to validate numrefidxactive against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices yield a zero POC difference in ffvvcmvscale,...

CVE-2026-125254

The FFmpeg software (versions through 9.0.2 ) is susceptible to a division by zero vulnerability within the VVC decoder . The root cause is that the ff_vvc_slice_rpl() function fails to validate num_ref_idx_active against the built reference list entries. An attacker can trigger this by providing...

EUVD-2026-120201

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder allocframe function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC H.266 file with a very large number of NAL units per access un...

CVE-2026-125251

FFmpeg versions through 9.0.2 are vulnerable to an integer overflow in the VVC decoder's alloc_frame() function, specifically within libavcodec/vvc/refs.c. On 32-bit builds , this flaw causes an undersized allocation of the reference picture list. An attacker can exploit this by providing a craft...

CVE-2026-125251 FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write via refs.c

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder allocframe function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC H.266 file with a very large number of NAL units per access un...

CVE-2026-125244 FFmpeg before 8.1.3 and 9.x before 9.0.2 VVC Decoder Out-of-Bounds Write via sh_entry_points

FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds write vulnerability in the VVC decoder's shentrypoints function in libavcodec/vvc/ps.c. Attackers can supply a crafted VVC H.266 bitstream whose SPS/PPS tile and WPP layout produces excess entry points, overflowing...

CVE-2026-125244

FFmpeg versions prior to 8.1.3 and 9.x before 9.0.2 are affected by an out-of-bounds write vulnerability within the VVC decoder 's sh_entry_points() function located in libavcodec/vvc/ps.c. An attacker can provide a crafted VVC (H.266) bitstream where the SPS/PPS tile and WPP layout generate an e...