FFmpeg through version 9.0.2 contains a NULL pointer dereference in the DPX encoder when handling 12‑bit RGB input. The bug occurs in the encode_gbrp12() routine, which dereferences uninitialized plane pointers if the bits_per_raw_sample value is not validated. An attacker can deliver a 12‑bit RGB image, such as a JPEG 2000 file, to the encoder; the vulnerability will cause the FFmpeg process to crash, resulting in a denial of service. The weakness is classified as CWE‑476.

All installations of FFmpeg 9.0.2 and earlier that employ the DPX encoder, especially when transcode processes 12‑bit RGB images. The issue affects the core FFmpeg library across all platforms that use the affected encoder implementation.

The vulnerability has a CVSS score of 6.8, indicating moderate severity. EPSS information is not available, and it is not listed in the CISA KEV catalog, which suggests no known widespread exploitation at the time of analysis. However, the attack vector is likely local or reachable remotely if FFmpeg processes untrusted media streams. An attacker who can supply a crafted 12‑bit RGB input can trigger a process crash, causing availability loss for services that rely on FFmpeg. The lack of a public exploit does not eliminate risk, as the fault is straightforward to trigger and can be leveraged in denial‑of‑service attacks.