This vulnerability arises from an uninitialized memory region in the GEM raster decoder of FFmpeg. Attackers can deliver crafted GEM .img files that use SKIP or pattern opcodes. The decoder copies uninitialized heap memory into decoded frames, resulting in an information disclosure that may expose sensitive data such as credentials or cryptographic material. The weakness is classified as CWE-908.

The flaw affects all FFmpeg builds that include the libavcodec/gemdec.c code through version 9.0.2. Users running FFmpeg 9.0.2 or earlier, or applications that depend on that version to decode .img files, are impacted. No vendor-released fix is available at present.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. Attackers must supply a malicious GEM image to a process that decodes it. The likely attack vector is local file processing or a service that consumes image data; remote exploitation would require that the service accept user-supplied images over a network.