CVE-2026-125213: FFmpeg through 9.0.2 Heap Buffer Overflow via PSD Decoder RLE Path

FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in the PSD decoder in libavcodec/psd.c that allows attackers to corrupt heap memory on 32-bit builds by supplying a crafted PSD image. Attackers can choose dimensions and channel counts whose product exceeds 4 GB, truncating the avmalloc allocation size so decoderle() writes attacker-controlled data past the buffer, causing crashes or possible code execution.