FFmpeg versions up to 9.0.2 include a vulnerability in the av1_frame_merge bitstream filter that causes an unbounded allocation of memory when a temporal delimiter OBU is never sent. A crafted .obu file, when processed by the AV1 OBU or Annex B demuxers, forces unlimited buffering of OBUs per temporal unit and can exhaust system memory, leading to a denial‑of‑service condition. The weakness is classified as CWE‑770: Uncontrolled Resource Consumption.

The affected product is FFmpeg, as supplied by the FFmpeg project. All releases through and including version 9.0.2 are vulnerable. Any installation that uses the av1_frame_merge filter to process AV1 bitstreams is exposed to this flaw.

The CVSS score of 6.8 indicates moderate severity. Exploitation requires the ability to supply a crafted .obu file to a system using FFmpeg’s av1_frame_merge filter; it is not a remote code execution flaw and the attack surface is limited to media handling components that enable the filter. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation activity. Nonetheless, the potential for memory exhaustion makes this a significant concern for systems that rely on FFmpeg for AV1 decoding.