The vulnerability is an uninitialized heap memory disclosure in the VMnc decoder of FFmpeg. A malicious VMnc stream can cause a frame to fail after loading a cursor shape, leading to bytes that were never written being exposed in the decoded output. This can allow an attacker to glean sensitive data from the framebuffer, resulting in potential data exposure and compromise of confidentiality.

FFmpeg official releases up to and including version 9.0.2 are impacted. The issue resides in the VMnc codec in libavcodec/vmnc.c and applies to all builds of FFmpeg that include that decoder prior to the patch, which is not yet released in a newer version.

The CVSS score of 4.8 classifies the issue as a medium‑severity data disclosure. An exploit requires feeding a crafted VMnc stream to the decoder, so the attack vector is inferred to be either local or remote execution of a vulnerable decoding routine, depending on how the library is used. The EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, indicating it may not be actively exploited yet, but it can still be leveraged by threat actors who target vulnerabilities in media processing.