CVE-2026-66037: FFmpeg IAMF Demuxer Uncontrolled Resource Consumption via mix_presentation_obu()

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationobu() function in libavformat/iamfparse.c calls avcalloc(countlabel, sizeof(languagelabel)) with an attacker-controlled value before validating available OBU data, enabling an allocation amplification of approximately 126 million bytes per input byte that exhausts process memory or triggers an OOM-kill during format probing.