PT-2026-141091

FFmpeg 9.0 through 9.0.2 built with liblcevc dec fails to validate LCEVC enhanced output dimensions against max pixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to force oversized get buffer2 allocation...