FFmpeg versions up to 9.0.2 contain a flaw in the Tiertex SEQ decoder where a failed RLE unpacking causes seq_decode_op1() to copy a 64‑byte block of uninitialized stack memory into the decoded frame. An attacker who can supply a crafted Tiertex SEQ file will end up with the contents of the stack visible in the output data, thereby leaking potentially sensitive information. The weakness is an uninitialized memory disclosure reflected in CWE‑908 and is limited to the decoder logic of the Tiertex SEQ format.

The vulnerability affects FFmpeg software up through version 9.0.2, across all platforms supported by the project. Any deployment that uses this version range and processes Tiertex SEQ files is impacted. No specific operating system limitation is stated, so typical installations—whether on servers, media transcoding pipelines, or client playback contexts—are included.

The CVSS score of 4.8 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting it is not widely exploited in the wild. The likely attack vector involves an attacker who can control or influence the input of a Tiertex SEQ file, such as through malicious uploads, remote file transfers, or compromised media streams. If exploited, the attacker can read portion of stack memory, potentially exposing secrets or aiding further attacks, but the impact is confined to disclosure rather than code execution or denial of service.