PT-2026-141004

FFmpeg through 9.0.2 contains an uninitialized memory read vulnerability in decode hybrid in libavcodec/flashsv.c that reads past decompressed data when decoding 15-bit color pixels. Attackers can supply a crafted Flash Screen Video 2 block whose inflated data ends mid-pixel to leak heap memory...