EUVD-2026-120175

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in aacadtstoascfilter that allows attackers to crash applications via oversized ADTS AAC packets. Attackers can supply a crafted file with a packet over 256 MB, overflowing the bit count so initgetbits fails unchecked and...