FFmpeg versions 8.0 through 9.0.2 contain a memory leak in the VP9 decoder caused by failure to reset a packet buffer during certain error paths in vp9_decode_frame. An attacker can craft a VP9 stream with invalid tile sizes that, when decoded with slice threading, leaks packet buffers and units until the decoding application runs out of memory. The resulting exhaustion can terminate the process or degrade performance, effectively denying service to legitimate users.

The affected product is FFmpeg, specifically all releases from 8.0 up to and including 9.0.2. Any application or service that uses these FFmpeg builds and processes VP9 video streams is vulnerable.

The CVSS score of 5.7 indicates a moderate severity. The EPSS value is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of widespread exploitation. The likely attack vector is remote delivery of a malicious VP9 stream to a victim application, such as through a malicious video file or network stream. If an application processes untrusted video data, an attacker can trigger the memory leak to cause a denial of service. The vulnerability exploits a memory management weakness (CWE‑401).