PT-2026-141030

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in vaapi hevc start frame in libavcodec/vaapi hevc.c that copies unbounded PPS tile counts into fixed-size arrays. Attackers can supply a crafted HEVC bitstream with a large picture and many tiles to write controlled 16-bit values...