The vulnerability in FFmpeg’s raw decoder allows a maliciously crafted AVI, MOV or NUT file to expose uninitialized heap memory. The rawdec() function reads rawvideo packets without verifying that the packet stride covers a full row for 1‑8 bits per pixel, causing garbage data to be output as a decoded frame. The leak can reveal sensitive information that was present on the heap at the time of decoding.

The flaw is present in FFmpeg versions up to and including 9.0.2. Any installation that processes the affected file formats—and especially those that handle media from untrusted sources—is at risk. The product is available across all platforms supported by FFmpeg.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. The attack requires a crafted media file, so the threat is most acute when FFmpeg receives untrusted input from remote or external sources. If a malicious file is processed, the uninitialized heap data could compromise the confidentiality of data held in the process.