CVE-2026-125227: FFmpeg through 9.0.2 Heap Buffer Overflow via cbs_jpeg_write_scan Integer Overflow

FFmpeg through 9.0.2 contains an integer overflow in cbsjpegwritescan() in libavcodec/cbsjpeg.c that causes a heap buffer overflow on 32-bit builds. Attackers can supply a crafted MJPEG/JPEG stream with a scan of 512 MiB or more, processed by CBS bitstream filters like filterunits, to corrupt the heap or crash the application.