CVE-2026-65704: FFmpeg 8.1.2 Out-of-Bounds Write via TY Demuxer and Shorten Decoder

FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demuxaudio() function decrements packet size without bounds checking, producing a negative size value that is passed to memcpy() in shortendecodeframe(), where conversion to sizet wraps the value to near SIZEMAX and triggers reads beyond the source allocation and writes far beyond the Shorten decoder's bitstream buffer.