FFmpeg versions 9.0.2 and earlier contain a null pointer dereference in the Motion Pixels decoder. The flaw arises because mp_decode_frame() ignores a failure from init_get_bits(), allowing an attacker to submit a packet of approximately 2^28 bytes through the libavcodec API. This causes the bit count to overflow and forces the decoder to read from a NULL buffer, resulting in a crash of the process.

The vulnerability affects the FFmpeg codec library, specifically releases up to and including 9.0.2. Any installation of FFmpeg 9.0.2 or any earlier version that has not applied the later patch is susceptible.

The CVSS score of 5.7 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires crafting a large media packet, which can be delivered via any interface that accepts raw media to the decoder, such as network streams or local files. Successful exploitation results in process termination rather than arbitrary code execution or data exposure.