CVE-2026-125231

FFmpeg versions 4.4 through 9.0.2 are vulnerable to a NULL pointer dereference in libavcodec/adxdec.c. The root cause is that adx_decode_header() updates the channel layout before validating the sample rate. A crafted ADX/AAX stream containing mid-stream new-extradata side data with an invalid sa...