FFmpeg versions through 9.0.2 contain an information disclosure flaw in the MLZ decompression routine used by the ALS decoder. The bug allows a crafted MPEG‑4 ALS file with malformed or out‑of‑range codes to cause the decoder to copy uninitialized heap memory into the decoded audio output buffer. Consequently, an attacker could exfiltrate sensitive data from uninitialized memory areas that may contain remnants of other processes, user credentials, or cryptographic material.

The vulnerability affects FFmpeg releases up to and including version 9.0.2. Systems running then or older may process malicious ALS files, potentially exposing private data.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to supply a specifically crafted ALS file to trigger the flaw, typically by luring an application or user to decode a malicious media file. While no remote execution vector is described, the disclosure could aid further attacks by revealing sensitive memory contents.