FFmpeg through version 9.0.2 contains an out-of-bounds read flaw in the PCM DVD encoder routine. When a 24‑bit audio stream of 48 or 96 kHz has a final frame with fewer samples than one block, the encoder’s loop counter wraps, causing the function to read memory beyond its intended bounds. The resulting crash stops the transcoding process. The weakness is identified by CWE-125 and carries a CVSS score of 6.8, indicating moderate severity.

The issue affects all FFmpeg releases up to and including 9.0.2. Systems that employ the FFmpeg library, particularly those running the pcm_dvd_encode_frame() routine to process 24‑bit audio streams, are potentially impacted. Updated versions released after 9.0.2 address the vulnerability.

The flaw poses a denial‑of‑service risk. An attacker who can supply a crafted 24‑bit 48 or 96 kHz audio file to a vulnerable FFmpeg instance can trigger the out‑of‑bounds read, causing the transcoder to crash. The EPSS score is unavailable, the vulnerability is not listed in CISA’s KEV catalog, and the CVSS 6.8 score signifies a non‑trivial impact. Exploitation does not provide code execution, but the crash requires remediation to prevent service interruption.