CVE-2026-125236

FFmpeg through 9.0.2 contains a memory leak vulnerability in allocframe in libavcodec/vvc/refs.c that leaks SPS and PPS references when frame buffer allocation fails. Attackers can supply a crafted VVC H.266 stream that repeatedly replaces parameter sets, steadily growing memory use and causing...