CVE-2026-125251

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder allocframe function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC H.266 file with a very large number of NAL units per access un...