PT-2026-141059

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adx decode header updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sampl...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in adxdecodeframe in libavcodec/adxdec.c. An attacker can trigger memory corruption or a crash by supplying a crafted ADX or AAX audio stream that delivers AVPKTDATANEWEXTRADATA mid-stream and changes the channel...