FFmpeg releases up through 9.0.2 suffer a memory leak in the mediaformat_jni_setBuffer() routine found in libavcodec/mediacodec_wrapper.c. The function allocates buffers using NewDirectByteBuffer() but never releases them, allowing the leak to accumulate each time a MediaCodec decoder is configured. This flaw creates a flaw that allows attackers to craft media files with large extradata, thereby consuming native memory indiscriminately and potentially exhausting system resources. The weakness is identified as a CWE-401: Unreleased Resource. The impact is confined to resource exhaustion rather than data theft or execution of arbitrary code.

Affected systems are Android applications that embed FFmpeg versions 9.0.2 or earlier. The vulnerable code is part of the FFmpeg project itself, and the version list is limited to the release series up to and including 9.0.2. Organizations using FFmpeg 9.0.2 or earlier in any executable that interfaces with MediaCodec on Android are potentially impacted.

The risk posture is modest. The CVSS score is 2.0, which reflects a low severity primarily due to lack of privilege escalation or direct data compromise. Exploit probability is unknown (EPSS not available) and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is via crafted media files; an attacker who can supply such files—whether locally or over a network—can drive the leak, making the vector a file‑based input attack. However, because the vulnerability does not provide a remote code‑execution path, the short‑term risk is limited to gradual resource exhaustion that could affect availability.