FFmpeg through 9.0.2 contains a heap buffer overflow in the PSD decoder. Attackers can supply a crafted PSD file whose dimensions and channel counts exceed 4 GB, causing a truncation of the allocation size in 32‑bit builds. The overflow allows overwrite of heap memory, which can crash the process or enable execution of attacker‑controlled code. This weakness is an arithmetic overflow that results in an under‑allocated buffer (CWE‑197).

The vulnerability affects FFmpeg version 9.0.2 and earlier on 32‑bit architectures. Systems that use the FFmpeg library to process PSD images on 32‑bit platforms are susceptible; 64‑bit builds are not impacted because the truncation does not occur. The affected product is the FFmpeg codec library included in many media processing applications.

The CVSS score of 7.3 indicates a serious risk. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, so current exploitation rates are unknown, but the potential for code execution makes it a high‑consequence flaw. The likely attack vector is the delivery of a malicious PSD file—either via a local file or an upload—to an application that decodes it with FFmpeg. Attackers need only provide the file; no privileged permissions are required beyond the application’s execution context. Rapid remediation is recommended for all systems running the affected FFmpeg versions.