FFmpeg up to version 9.0.2 has a flaw in the WebP decoder where a short uncompressed ALPH chunk causes the alpha plane memory to remain uninitialized. This allows an attacker to obtain stale pixel data from previously decoded frames, leaking confidential information from adjacent frames. The defect is categorized as CWE-908.

This issue affects any installation of FFmpeg that includes versions 9.0.2 or earlier. The vulnerability is present in the library function vp8_lossy_decode_alpha() within libavcodec/webp.c, so any process that uses FFmpeg to decode WebP images is potentially impacted.

The vulnerability has a CVSS score of 4.8. No EPSS data is available, and the flaw is not catalogued in the CISA KEV list, suggesting moderate risk with uncertain exploitation prevalence. The likely attack vector is the delivery of a maliciously crafted WebP image to the FFmpeg decoder. The attacker would need a path to supply that media—for example, through media conversion services, file upload mechanisms, or multimedia playback of untrusted content. The impact is limited to disclosure of confidential data; there are no known integrity or availability effects.