An out-of-bounds read in the Vorbis encoder’s put_vector() routine occurs when NaN samples trigger a codebook index of –1. This results in the function reading heap memory beyond the input array bounds, potentially crashing the encoder or leaking adjacent heap contents into the encoded output. The flaw does not provide remote code execution but can lead to denial of service or unintended disclosure of information stored on the heap.

FFmpeg, the open‑source multimedia framework, is affected for all releases prior to version 8.1.3 and for all 9.x series releases earlier than 9.0.2. Upgrading to any release equal to or newer than these thresholds contains the fix, while older builds remain vulnerable.

The CVSS score of 5.8 indicates medium severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, implying limited evidence of active exploitation. The attack requires an attacker to supply audio data containing NaN float samples to the native Vorbis encoder, which is achievable by a local or privileged adversary who can control input to the encoder. Successful exploitation would crash the application or expose adjacent heap memory, potentially revealing sensitive data.