CVE-2026-125231

FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerability in libavcodec/adxdec.c because adxdecodeheader updates the channel layout before validating the sample rate. Attackers can supply a crafted ADX/AAX stream with mid-stream new-extradata side data carrying an invalid sample...