FFmpeg through version 9.0.2 contains a memory leak in libavcodec/libx265.c because the function libx265_encode_frame never frees the rpu.payload that is allocated by ff_dovi_rpu_generate. When attackers provide crafted Dolby Vision HEVC or AV1 files, each frame that is transcoded leaks one RPU allocation, leading to unbounded memory growth. The vulnerability is a memory leak, marked as CWE‑401, and results in a denial of service through excessive memory consumption.

The affected product is FFmpeg, version 9.0.2 and any earlier releases that have not applied the hotfix. No other vendors or products are listed by the CNA.

The CVSS score of 6.8 places the flaw in the moderate severity range. EPSS data is not available, so the likelihood of exploitation is unknown but not considered negligible. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is via crafted Dolby Vision or AV1 files supplied to an FFmpeg instance, i.e., file input to a local or remote media processing service.