The vulnerability resides in FFmpeg's prores_ks encoder and allows an attacker to provide a specially crafted video stream with an alpha channel and odd‑height interlaced frames. Under these conditions the get_alpha_data() function reads from before the start of its internal blocks buffer, capturing arbitrary memory that then gets written into the output alpha plane. The resulting encoded file can therefore contain leaked memory from the FFmpeg process, potentially exposing sensitive data or corrupting the output.

FFmpeg versions up to and including 9.0.2 are affected. The flaw applies to all builds that utilize the prores_ks encoder when generating interlaced ProRes 4444 streams with alpha data. Users running any derivative of 9.0.2 or earlier and employing this encoder configuration are at risk, regardless of operating system or distribution.

The CVSS score of 2 indicates very low severity. EPSS information is unavailable, and the issue is not listed in CISA’s KEV catalog, implying a low probability of widespread exploitation. Exploitation requires an attacker to supply malicious input to the encoder; no network or remote code execution channel exists. The risk therefore centers on inadvertent data leakage or corruption of the encoded output when the encoder processes crafted input.