EUVD-2026-120216

FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure vulnerability in oldcodec23 of libavcodec/sanm.c that leaks stack bytes into decoded frames. Attackers can supply a crafted LucasArts SMUSH/SANM animation using codec 23 with an inline table to expose decoder process stack...