FFmpeg versions 4.4 through 9.0.2 contain a use‑of‑uninitialized variable flaw in the CDXL decoder. The bug allows crafted type‑0 CDXL files to trigger unfilled HAM palette entries, resulting in stack memory being written into decoded pixels. An attacker who supplies such a file can read stack bytes and pointer fragments in the BGR24 output, exposing potentially sensitive data. The weakness is directly tied to improper handling of buffer initialization (CWE‑457).

All FFmpeg installations between 4.4 and 9.0.2 that include the CDXL decoder are vulnerable. Since the decoder is enabled by default in all standard builds, any system running a susceptible version and processing CDXL files is affected.

The CVSS score of 6.8 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a maliciously crafted CDXL file that an attacker can embed in a larger payload or deliver as a media file. While the flaw does not grant arbitrary code execution, the leaked stack data could support further attacks such as credential extraction or aiding in exploitation of other vulnerabilities.