FFmpeg versions through 9.0.2 contain an uninitialized memory disclosure in the TAK decoder, where the tak_decode_frame() function fails to verify that multichannel decorrelation lists cover all channels. This oversight allows attackers to craft TAK files that omit certain channels, causing unde Code flagged buffer areas to leak heap memory through decoded audio output. The disclosure can expose sensitive data that resides in the VM’s memory, thereby compromising confidentiality. The vulnerability does not provide remote code execution or denial of service but can leak arbitrary memory contents.

The flaw is present in FFmpeg, specifically in the libavcodec takdec.c component, affecting all FFmpeg releases up to and including 9.0.2. Users of FFmpeg on any platform that processes TAK audio files are potentially impacted.

The CVSS score of 4.8 indicates a moderate risk profile; the EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting low current exploitation probability. Likely attackers must supply a crafted TAK file to the FFmpeg process, either remotely via a malicious media stream or locally by manipulating media data. Successful exploitation results in memory disclosure, but it does not lead to arbitrary code execution or service disruption.