FFmpeg versions 7.1 through 9.0.2 contain a NULL pointer dereference in the ff_dovi_rpu_generate function within libavcodec/dovi_rpuenc.c. The flaw allows an attacker to supply crafted Dolby Vision RPU metadata that are processed by the dovi_rpu bitstream filter with compression enabled, resulting in a crash of the FFmpeg process and a denial of service. This weakness corresponds to CWE-476.

FFmpeg, a multimedia framework widely used for encoding and decoding, is affected. All releases from 7.1 up to 9.0.2 are vulnerable. Systems running FFmpeg in this version range, especially those that enable the Dolby Vision RPU bitstream filter with compression, are at risk.

The CVSS score is 5.7, indicating a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the crash by supplying a crafted input stream to ffmpeg with the Dolby Vision RPU filter enabled and compression activated. The process must have access to the vulnerable library, so the risk is typically local to a system that runs ffmpeg on untrusted input. However, if ffmpeg is exposed as a service that processes user‑submitted media, remote exploitation could lead to denial of service. No publicly available exploit has been reported, but the vulnerability is straightforward to reproduce using a custom payload.