CVE-2026-125264

FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parse frame header() in libavcodec/jpegxl parser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a permuted TOC and huge toc count, making the parser loop excessively and exhaust CPU.