CVE-2026-125173

FFmpeg versions through 9.0.2 are vulnerable to a memory leak in the libxevd_receive_frame() function within libavcodec/libxevd.c. The root cause is a failure to free pkt_au when an access unit produces no picture. An attacker can exploit this by providing a crafted EVC stream containing numerous...