CVE-2026-125251: FFmpeg through 9.0.2 VVC Decoder Heap Out-of-Bounds Write via refs.c

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the VVC decoder allocframe() function in libavcodec/vvc/refs.c that undersizes the reference picture list allocation on 32-bit builds. Attackers can supply a crafted VVC (H.266) file with a very large number of NAL units per access unit to trigger heap out-of-bounds writes and corrupt memory.