PT-2026-141097

FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs sei.c where cbs sei delete message leaves a stale extension data reference that ff cbs sei add message reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extensi...