PT-2026-140996

FFmpeg through 9.0.2 contains an information disclosure vulnerability in ff mlz decompression in libavcodec/mlz.c, which accepts string codes beyond the dictionary's next free code. Attackers can supply a crafted MPEG-4 ALS file with malformed initial or out-of-range codes to copy uninitialized...