CVE-2026-125187

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in the TTA encoder's tta encode frame() in libavcodec/ttaenc.c, which never reserves output packet space for the 4-byte CRC. Attackers can supply audio whose sample values and length produce a small, poorly compressible final frame, triggering the av assert0() in flush put bits() and aborting applications transcoding to TTA.