PT-2026-140979

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv decode inter in libavcodec/eatgv.c that ignores init get bits failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter frame with a 2^28-byte compressed block...