CVE-2026-125253

FFmpeg through 9.0.2 contains an integer overflow in cbs vp9 split fragment() in libavcodec/cbs vp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame sizes, causing out-of-bounds reads that crash 32-bit applications.