A reference count leak in FFmpeg 9.0.2's V4L2 mem2mem decoder can cause a deadlock when processing crafted H.264, HEVC, or VP9 streams with resolution changes. The leak triggers an endless wait in ff_v4l2_m2m_codec_reinit(), leading the decoding application to hang and deny service. The weakness identified by CWE-911 is a resource exhaustion flaw that escalates to a system impact.

The vulnerability affects FFmpeg versions up to and including 9.0.2. Any installation that uses the V4L2 mem2mem decoder component for multi-plane capture formats is potentially impacted. The affected code resides in libavcodec/v4l2_buffers.c within the FFmpeg project.

The CVSS score of 5.7 indicates moderate severity. Since EPSS data is not available, the exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the defect by providing malicious video streams, making it feasible to poison a system that relies on V4L2 decoding. A successful exploit would result in an application hang, potentially allowing attackers to disrupt service continuity but not granting broader system compromise.