FFmpeg versions up to 9.0.2 feature an integer overflow in the OpenEXR decoder, where the tile count calculation is incorrect. A malicious image file with large dimensions and very small tiles can force the decoder to skip proper processing, causing uninitialized memory or stale frame data to be exposed. This flaw directly permits attackers to read potentially sensitive data from memory, although it does not enable code execution or complete denial of service. The weakness is a classic integer overflow vulnerability described by CWE-190.

This issue affects FFmpeg, a widely used multimedia framework, as identified by the CNA. The vulnerability applies to all releases of FFmpeg compiled with the OpenEXR decoder up to and including version 9.0.2. No specific sub-products or operating systems are singled out, so any system that uses FFmpeg to decode OpenEXR images may be exposed if it runs an affected version.

The CVSS score of 4.8 indicates a medium severity. The EPSS score is not available, but the lack of a high EPSS does not diminish the real risk because the vulnerability can be exploited with a crafted OpenEXR file, which is easy to create. The KEV status shows it is not yet listed in CISA's catalog, but the potential for memory disclosure remains significant. The likely attack vector is file‑based, requiring an attacker to deliver a malicious OpenEXR image to the victim's FFmpeg process—either directly through user‑controlled input or indirectly via software that processes media files.