FFmpeg versions up to 9.0.2 contain an uninitialized memory vulnerability in the DXA decoder in libavcodec/dxa.c that can leak leftover heap contents when decoding type 4 DXA frames. The flaw allows attackers to read data that should be private to the process, exposing potentially sensitive information. The weakness is classified as CWE-908: Uninitialized Variable Usage, and it results in a moderate severity vulnerability with a CVSS score of 4.8.

FFmpeg software, specifically all releases up to and including version 9.0.2. No newer releases are known to be affected.

Attackers can supply a crafted DXA video containing a type 4 frame to induce the decoder to copy uninitialized buffer contents into output pictures, thereby revealing heap data. The attack vector is likely local or remote via any service that decodes arbitrary DXA files; it requires the ability to feed a malicious DXA payload to the FFmpeg decoder. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. With a CVSS base score of 4.8, the risk is moderate, but the impact rests on whether the victim process handles user‑supplied DXA files.