PT-2026-141081

FFmpeg through 9.0.2 contains an integer overflow in cbs vp9 split fragment in libavcodec/cbs vp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that...