Code execution via cross-plane cdef write

Heap-buffer overflow in FFmpeg before 8.0 allows remote authenticated users to execute code or crash a process via crafted JPEG2000 data. The jpeg2000dec cdef handler accepts a channel association that maps full-resolution luma rows into a smaller subsampled chroma plane, so write_frame_8 writes past the plane allocation. Exploitation requires a process to decode attacker-controlled JPEG2000 with chroma subsampling and a crafted cdef atom; the published proof of concept demonstrates a crash, while code execution is the stated upper bound.