FFmpeg versions up to 9.0.2 contain a NULL pointer dereference that occurs when init_get_bits() fails after a signed integer overflow in mp_decode_frame(). The bug allows an attacker to supply an oversized packet to the mp3adu decoder via the libavcodec API, causing the decoder to read through a NULL buffer and crash the application. This results in a denial‑of‑service condition rather than arbitrary code execution or data disclosure.

The vulnerability is present in FFmpeg 9.0.2, the official release from the FFmpeg project. Any installation that uses this exact version and processes MPEG audio frames through the libavcodec API is impacted. Systems that rely on FFmpeg for media handling, such as streaming servers, transcoding services, or media players, must review whether they use the affected build.

The CVSS score of 5.7 indicates a moderate risk of exploitation. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog, suggesting no widely observed exploitation. Attacks require the ability to supply crafted MPEG audio packets to the decoder, implying a local or possibly remote attack vector if untrusted media is accepted by a public‑facing service. The impact is limited to crashing the process, which could disrupt availability but does not grant further privileges or information. Given the lack of known exploits, mitigation is primarily preventive.