CVE-2026-125070

FFmpeg versions through 9.0.2 are vulnerable to a NULL pointer dereference in the tqi_decode_frame() function within libavcodec/eatqi.c. The vulnerability occurs because the software ignores an init_get_bits() failure following an integer overflow . An attacker can trigger this by providing a cra...