6 matches found
CVE-2026-125066
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decodeframe ignores initgetbits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads...
CVE-2026-125066 FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decodeframe ignores initgetbits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads...
CVE-2026-125066
FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in the Cirrus Logic AccuPak (CLJR) decoder located in libavcodec/cljrdec.c. The root cause is that the decode_frame() function ignores the failure of init_get_bits(). An attacker can trigger this by providing a crafted AVI...
EUVD-2026-120241
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decodeframe ignores initgetbits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads...
CVE-2026-125066: FFmpeg: FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in…
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decodeframe ignores initgetbits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing reads...
PT-2026-140980
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak CLJR decoder in libavcodec/cljrdec.c because decode frame ignores init get bits failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR frame that overflows the bit count, causing rea...