CVE-2026-125238

FFmpeg through 9.0.2 contains a reachable assertion vulnerability in libxevd receive frame() in libavcodec/libxevd.c that returns success when an access unit produces no frame. Attackers can supply a crafted EVC file with truncated or picture-less access units to trigger the av assert0() on frame->private ref, aborting any decoding application.