CVE-2026-125199

FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1 decode frame() in libavcodec/vc1dec.c that leaks slice buffers when init get bits8() fails. Attackers can supply crafted files with repeated oversized VC-1 slices exceeding the bit reader limit to exhaust memory of decoding applications.