The vulnerability is a NULL pointer dereference in the aac_adtstoasc_filter function of FFmpeg versions up to 9.0.2. Attackers can supply an AAC ADTS packet larger than 256 MB, causing an overflow in the bit count used by init_get_bits and resulting in an unchecked failure of get_bits. When this occurs during remuxing of MP4, Matroska, FLV, or LATM containers, the affected application crashes, yielding a denial‑of‑service condition. The weakness is identified as CWE‑252.

FFmpeg software, versions up to and including 9.0.2, in all builds that employ the aac_adtstoasc bitstream filter. Systems that process audio streams via FFmpeg, such as media players, transcoding services, or streaming servers, are potentially impacted.

The CVSS score of 6.8 reflects a moderate likelihood of exploitation and impact. Because the EPSS score is not available, the exact probability of exploitation cannot be quantified, but the absence of a KEV listing suggests no known widespread exploitation yet. Attackers would need to supply a specially crafted audio file or stream containing an oversized ADTS packet. This is likely a local or remote file‑processing vector, as any application using the vulnerable filter and ingesting such a file could trigger the crash. The vulnerability leads to application crashes but does not grant code execution or data disclosure.