FFmpeg libraries up through version 9.0.2 contain an uninitialized memory use flaw in the RoQ DPCM encoder. When an encoder flush occurs early, the routine roq_dpcm_encode_frame() writes stale heap data from the frame_buffer into the output packets. This allows attackers to expose internal memory contents, elevating the vulnerability to a data‑leak scenario. The weakness is rooted in the misuse of an uninitialized variable, a classic CWE‑908 issue.

Systems running FFmpeg versions up to 9.0.2 are affected. Any deployment that employs the RoQ DPCM encoder for media transcoding should assume exposure until the software is updated to a patched release.

The CVSS score of 4.8 indicates a low severity impact under the current scoring methodology. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector involves supplying maliciously crafted audio streams under eight frames to an application that performs RoQ DPCM transcoding; once flushed early, the encoder leaks uninitialised heap contents into the output. While the flaw does not grant code execution or privilege escalation, it does allow confidential data to be disclosed to an attacker able to control the encoding input. The overall risk is moderate compared to higher‑impact flaws, but the potential for sensitive data leakage makes remediation a priority for any affected systems.