The vulnerability occurs in FFmpeg version 8.0 and 8.0.1 when decoding RV60 video streams. During decoding, the quantization parameter (qp) validation only checks for values less than zero but does not enforce the upper bound. A malicious encoder can produce a qp of up to 65, which exceeds the rv60_qp_to_idx array size of 64. The resulting out-of-bounds array accesses in decode_cbp8, decode_cbp16, and get_c4x4_set functions lead to memory disclosure or a crash. This weakness corresponds to CWE‑125 (Out‑of‑Bounds Read).

Affected systems are installations of FFmpeg version 8.0.0 (released 2025‑08‑22) and 8.0.1 (released 2025‑11‑20) that use the RV60 decoder. The vulnerability is tracked by CPE identifiers cpe:2.3:a:ffmpeg:ffmpeg:8.0:* and cpe:2.3:a:ffmpeg:ffmpeg:8.0.1:*. Any environment that processes RV60 video frames with these FFmpeg releases is impacted.

The CVSS base score is 5.4, indicating a moderate risk. EPSS is less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Based on the description, it is inferred that a malicious RV60 video file can trigger the flaw, causing either a crash or memory disclosure; this attack would be local to the process that decodes the file, but could also lead to denial of service if the user or application is not protected. No remote code execution is indicated. The mitigation is to upgrade to FFmpeg 8.1 or later where the issue is fixed.