FFmpeg through version 9.0.2 contains a heap buffer overflow in ff_libwebp_get_frame() inside libwebpenc_common.c. When the cr_threshold parameter is set and a media stream raises the resolution mid‑stream, a memcpy() writes pixel data past the stale reference frame. This corrupts memory and can crash the application, and if an attacker can supply a carefully crafted payload it could lead to arbitrary code execution.

All installations of FFmpeg version 9.0.2 or earlier are affected. Any software that embeds FFmpeg and uses the libwebp encoder for processing media will be vulnerable, including media conversion tools, streaming servers, or any application that decodes or encodes WebP images.

The CVSS score of 7.3 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not listed in CISA's KEV catalog. The likely attack vector is delivering a malicious media file to an application that uses the libwebp encoder; no local privilege escalation is required. Exploitability is low to moderate, but the impact on confidentiality, integrity, or availability is significant due to potential memory corruption and denial of service.