FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that enables leakage of stack memory via out‑of‑range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette, causing the kempf_restore_buf() routine to copy uninitialized stack bytes—including pointers and stack guards—into decoded output. This flaw results in potential exposure of sensitive data and therefore a confidentiality impact.

The affected product is the FFmpeg multimedia framework, versions 2.0 through 9.0.2. All builds of FFmpeg within this range that include the Go2Meeting decoder are vulnerable.

The CVSS score of 6.8 categorizes the issue as moderate in severity, and the EPSS score is not available, so the exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog, but it can be triggered by any application that accepts G2M streams and decodes them with FFmpeg. Based on the description, it is inferred that the attack vector is a crafted G2M stream supplied to a vulnerable decoder, with no authentication or privileged access required.