The flaw resides in FFmpeg's decryption initialization path for MOV files. When an attacker supplies an MP4 containing thousands of tiny pSSH boxes, the demuxer builds an extensive linked list of AVEncryptionInitInfo structures. Freeing that list causes av_encryption_init_info_free() to recurse for every node, exhausting the stack and crashing the process. The recursive traversal also results in quadratic CPU usage, which can degrade performance or lead to a resource exhaustion denial of service. This behavior corresponds to CWE-674 (Uncontrolled Recursion) and CWE-770 (Out‑of‑Bounds Write).

FFmpeg versions 9.0.2 and earlier are affected. The vulnerable code resides in libavformat/mov.c and libavutil/encryption_info.c. Any build of FFmpeg that has not applied the subsequent patch and is used to process MP4 files is susceptible.

The CVSS score of 5.7 indicates moderate severity, with potential to crash the process and consume excessive CPU, leading to denial of service. The EPSS score is not available, so the likelihood of exploitation is unclear from publicly available data. The flaw is not listed in CISA's KEV catalog. An attacker can exploit the issue by creating a malicious MP4 file with an unusually large number of small pSSH boxes. The likely attack vector is local file input to an application that uses the vulnerable FFmpeg build, but the risk could be extended to remote exploitation if the application provides a file upload or media ingestion endpoint that accepts MP4 content.