The flaw lives in FFmpeg's C93 video decoder where the decode_frame function fails to confirm how many color table bytes were copied. An attacker can supply a truncated Interplay C93 file, causing the subsequent draw_n_color routine to write uninitialised stack bytes into the decoded frame. This writes data that was on the stack into the output buffer, revealing arbitrary stack contents and potentially exposing sensitive information to the attacker.

FFmpeg releases through version 9.0.2 are vulnerable. The issue is present in libavcodec/c93.c and applies to any deployment that uses FFmpeg 9.0.2 or earlier and accepts Interplay C93 video streams.

The CVSS score of 4.8 indicates moderate risk. No EPSS value is available and the vulnerability is not currently listed in the CISA KEV catalog, suggesting a relatively low likelihood of widespread exploitation. The expected attack vector is an application that decodes user‑supplied Interplay C93 files; the attacker must create a crafted file to trigger the disclosure, and the impact is limited to leaking previously local stack data, not remote code execution or privilege escalation.