PT-2026-140981

FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble decode frame in libavcodec/vble.c because it ignores init get bits failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causing reads from a NULL bit reader buffer tha...