CVE-2026-125173

FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevdreceiveframe in libavcodec/libxevd.c that fails to free pktau when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only parameter sets or non-frame NAL units to...

CVE-2026-125238: FFmpeg: FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevd_receive_frame() in libavcodec/libxevd.c…

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevdreceiveframe in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the avassert0 on...

PT-2026-141000

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevd receive frame in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to re...

PT-2026-141001

FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevd receive frame in libavcodec/libxevd.c that fails to free pkt au when an access unit produces no picture. Attackers can supply a crafted EVC stream with many access units containing only parameter sets or non-frame NAL units to...

PT-2026-141066

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevd receive frame in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the av assert0 on...