CVE-2026-125171

FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the Musepack SV7 decoder because mpc7 decode init() does not validate lastframelen against MPC FRAME SIZE. Attackers can supply a crafted Musepack SV7 file declaring an oversized final frame, causing consumers of decoded frames to read past the audio buffer, leading to crashes or heap memory disclosure.