The vulnerability appears in the Huffyuv decoder of FFmpeg. When processing certain short packed-BGR bitstreams, the decoder fails to initialize a temporary buffer before writing to it, causing uninitialized heap bytes to be inserted into decoded pixel data. An attacker can therefore craft a Huffyuv video file that causes the output frames to contain portions of the heap, exposing arbitrary memory content. The flaw does not provide direct control over execution, but the resulting memory leakage can lead to privacy breaches if the decoded frames are displayed or stored.

Affected products are FFmpeg versions 2.3 through 9.0.2. All builds that include the unpatched Huffyuv decoder are vulnerable. Systems that run these versions and process user-supplied Huffyuv video streams are at risk.

The CVSS score of 6.8 indicates moderate to high risk. EPSS is not available, so the exploitation probability is uncertain but likely low. The issue is not listed in the CISA KEV catalog. Exploitation requires only a crafted video file and no privileged execution, enabling an attacker to trigger memory leakage by delivering a malicious Huffyuv file to any application that decodes it. The primary impact is information disclosure rather than denial of service or code execution.