FFmpeg 9.0.2 and earlier contain an infinite loop in the bit_allocation() function of libavcodec/imc.c. The flaw is triggered when decoding IMC or IAC audio blocks that supply a negative bit budget. When the freebits value goes negative the loop that reduces this value never terminates, forcing the CPU to spend 100 % of its cycles in the decoder and rendering the process unresponsive.

The vulnerability affects the FFmpeg library up to and including version 9.0.2. Any system or application that uses this version of FFmpeg for audio decoding of IMC or IAC files is susceptible. The common platform enumeration identifies the product as ffmpeg:ffmpeg, and affected vendors/products list only FFmpeg.

The CVSS score of 6.8 indicates a medium severity for disruption. EPSS data is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via a maliciously crafted audio file processed by an application that links to the vulnerable FFmpeg library; this inference is based on the description of an attacker supplying such a file to trigger the infinite loop.