FFmpeg before version 9.0.2 contains a NULL pointer dereference in libavcodec/jvdec.c. When the library processes an oversized JV video packet—roughly 268 435 460 bytes—the bit count variable overflows, causing decode_frame() to read from a NULL buffer and crash the application. Because the crash terminates the process, the vulnerability provides a denial‑of‑service vector but does not allow code execution or information disclosure.

All FFmpeg installations that use the default JV decoder built into libavcodec and whose version is 9.0.2 or earlier are vulnerable. This includes the release series up to, and including, FFmpeg 9.0.2. Newer releases that have applied the patch are not affected.

The CVSS score of 5.7 places the issue in the medium range. No EPSS value is reported, and the vulnerability is not listed in CISA's KEV catalog, so the current likelihood of widespread exploitation is uncertain. Nevertheless, any application that receives untrusted audiovisual data and passes it to FFmpeg for decoding could be targeted. The intrusion requires the attacker to supply the malformed packet, so a local or network channel that can deliver custom data to the decoder is needed. Successful exploitation would simply crash the host process, resulting in service disruption.