CVE-2026-125238

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevdreceiveframe in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the avassert0 on...

CVE-2026-125172

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in libxevdreceiveframe in libavcodec/libxevd.c that fails to validate NAL unit length prefixes against remaining packet data. Attackers can supply crafted EVC media with oversized 4-byte NAL length prefixes, causing libxevd to read...