CVE-2026-125251

FFmpeg versions through 9.0.2 are vulnerable to an integer overflow in the VVC decoder's alloc_frame() function, specifically located in libavcodec/vvc/refs.c. On 32-bit builds , this flaw causes an undersized allocation for the reference picture list. An attacker can exploit this by providing a ...