CVE-2026-125251

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder allocframe function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC H.266 file with a very large number of NAL units per access un...

CVE-2026-125236

FFmpeg through 9.0.2 contains a memory leak vulnerability in allocframe in libavcodec/vvc/refs.c that leaks SPS and PPS references when frame buffer allocation fails. Attackers can supply a crafted VVC H.266 stream that repeatedly replaces parameter sets, steadily growing memory use and causing...