FFmpeg versions up to 9.0.2 contain an uncontrolled memory allocation flaw in the Interplay ACM decoder that permits an attacker to supply a crafted ACM file with extreme level and row counts to cause the decode_init() routine to allocate nearly one gigabyte of memory. This excessive allocation can exhaust system resources and crash or stall the decoding process. The flaw is a classic example of CWE‑789, where resource allocation is not properly bounded.

The affected product is FFmpeg. All FFmpeg releases through version 9.0.2 are impacted; newer releases are presumed to have the fix applied.

The CVSS score for this vulnerability is 6.8, indicating a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. Attackers would need access to a system running FFmpeg that decodes a supplied ACM file; the attack can be performed locally by any user who can cause the software to parse the file, or remotely if the software processes media from a network source. Successful exploitation would lead to memory exhaustion, potentially resulting in a denial of service or application crash.