The flaw is a heap buffer overflow in the VideoToolbox encoder of FFmpeg versions up to 9.0.2. The encoder copies frames larger than the configured dimensions into undersized image buffers, allowing crafted media to overflow a heap buffer. This can overwrite adjacent memory, leading to application crashes or, if exploited carefully, arbitrary code execution. The vulnerability requires the attacker to provide a media stream whose resolution grows during processing, taken advantage of when the encoder does not perform rescaling.

FFmpeg releases up to and including version 9.0.2 are affected. Users running FFmpeg on any platform that utilizes the VideoToolbox encoder for media transcoding are at risk, as the CPE indicates all FFmpeg installations may be impacted.

The CVSS score of 7.3 reflects moderate severity. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified currently. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote media processing, as the exploit requires feeding a crafted media file to FFmpeg during transcoding. An attacker who can influence FFmpeg's input channel can trigger the overflow, potentially causing a crash or memory corruption that may lead to code execution if the attacker can manipulate the overwritten heap content.