FFmpeg through version 9.0.2 includes a memory leak in the VC-1 decoder. When init_get_bits8() fails, slice buffers are not freed, allowing an attacker to supply crafted media files with oversized VC-1 slices that exceed the bit reader limit. The resulting leak can exhaust the memory of any application that uses the decoder, leading to a denial-of-service condition. This vulnerability is classified as CWE-401.

The affected software is the FFmpeg library, specifically the libavcodec VC-1 decoder, in all releases up to and including 9.0.2. Any system that invokes FFmpeg or includes the library to decode VC-1 content is potentially vulnerable. This includes media players, streaming servers, and any other applications that embed FFmpeg for video processing.

The CVSS score of 6.8 places the flaw in the medium severity range. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. However, the attack requires only a crafted media file; the likely attack vector is local or remote if the vulnerable decoder processes untrusted input. Because the flaw can cause memory exhaustion, the risk to availability is significant, especially in environments that handle large volumes of VC-1 content.