CVE-2026-125269

FFmpeg through 9.0.2 contains a double free vulnerability in libavcodec/cbs sei.c where cbs sei delete message() leaves a stale extension data reference that ff cbs sei add message() reuses. Attackers can supply a crafted H.264 stream with a display orientation SEI message followed by payload extension data, processed by h264 metadata with display orientation=insert, to corrupt heap memory.