FFmpeg versions up to and including 9.0.2 can be forced to consume excessive CPU cycles when parsing certain Vorbis streams. The flaw occurs in libavcodec/vorbis_parser.c where invalid extradata is re‑parsed for every packet as long as valid_extradata stays false. A crafted Ogg or Matroska Vorbis stream with a large amount of invalid extradata and many packets can trigger continuous re‑parsing, exhausting system resources and resulting in a denial‑of‑service. This weakness is a classic resource exhaustion flaw, classified as CWE‑400, affecting the availability of the service but not directly compromising data integrity or confidentiality.

The vulnerability applies to the FFmpeg multimedia framework, specifically all releases through version 9.0.2. Anyone deploying FFmpeg on a server, workstation, or embedded device that may decode or probe Ogg/Matroska Vorbis media – for example broadcasters, media servers, video players, or automated transcoding pipelines – could be impacted if they run an affected instance without this fix.

Assessment indicates a CVSS score of 6.8, reflecting a moderate severity due to denial of service without elevated privileges. Because the EPSS score is unavailable, the current exploitation likelihood is uncertain, yet the lack of a KEV listing suggests no active widespread exploitation reports. Exploitation requires an attacker to deliver a specially crafted Vorbis stream that a vulnerable FFmpeg process must demux or probe; thus it typically occurs in contexts where the software processes untrusted media, such as cloud media services or user‑supplied content. Until the build is updated, an attacker could repeatedly send large invalid packets to a target system to exhaust CPU and render the service unresponsive.