FFmpeg versions up to 9.0.2 include a vulnerability in the ape_decode_frame() function where the legacy Monkey's Audio frame limit of 73,728 samples is not enforced. An attacker can construct an APE file that declares a very large nblocks value, causing the decoder to allocate gigabytes of memory, destabilising the host process and resulting in a denial of service. This weakness falls under CWE-789, Uncontrolled Memory Allocation.

All builds of FFmpeg up to and including 9.0.2 are affected. The CVE applies to the open‑source FFmpeg project, version 9.0.2 and all earlier releases.

The CVSS score of 6.8 classifies this as a moderate severity flaw, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, inferred from the fact that an attacker can supply a crafted APE file to any component that performs decoding, such as media players or web servers that process user‑supplied audio. Exploitation requires only the ability to deliver a malicious file to the susceptible decoder, which is typical in many real‑world scenarios. Given the moderate score and absence of publicly known exploits, the risk is considered moderate but still significant because memory exhaustion can degrade or crash services.