PT-2026-141074

FFmpeg through 9.0.2 contains a denial of service vulnerability in cbs jpeg assemble fragment that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an av assert0 abort when CBS-based bitstream filters...