PT-2026-140978

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726 decode frame in libavcodec/g726.c because it ignores init get bits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk to make the decoder read from a NULL...