FFmpeg versions up to 9.0.2 contain a flaw in the G.726 ADPCM decoder that ignores failure from init_get_bits() when processing oversized packets, allowing a NULL pointer dereference in g726_decode_frame(). An attacker can craft an AVI file with a 268,435,392‑byte G.726 audio segment to force the decoder to read from a NULL buffer, causing the process to crash. The vulnerability is classified as CWE‑252 and results in a denial of service rather than direct code execution or data compromise.

The affected product is FFmpeg for all platforms, specifically versions 9.0.2 and earlier. Systems that rely on multimedia decoding or server‑side transcoding using these FFmpeg binaries without an updated build are susceptible. No particular operating‑system requirement is stated, so any host executing a vulnerable FFmpeg instance could be impacted.

The CVSS base score is 6.8, indicating moderate severity. No EPSS information was provided, so the likelihood of exploitation cannot be quantified, and the vulnerability is not in the CISA KEV catalog. Based on the description, the most likely attack vector is a local or remote attacker supplying a malicious AVI file to a media pipeline that invokes the affected decoder. Successful exploitation would lead to a service crash, potentially disrupting media services but without immediate data loss or code execution.