CVE-2026-125251 | FFmpeg up to 9.0.2 VVC decoder libavcodec/vvc/refs.c alloc_frame integer overflow

November 9, 2026 Yanac

A vulnerability categorized as problematic has been discovered in FFmpeg up to 9.0.2. This affects the function alloc_frame of the file libavcodec/vvc/refs.c of the component VVC decoder. Such manipulation leads to integer overflow.

This vulnerability is traded as CVE-2026-125251. An attack has to be approached locally. There is no exploit available.VulDB Recent EntriesRead More