The vulnerability is an integer overflow in the VVC decoder's alloc_frame() function that causes the reference picture list to be undersized on 32-bit builds. An attacker can craft a VVC (H.266) file with a very large number of NAL units per access unit to trigger a heap out-of-bounds write and corrupt memory. This corruption can lead to a crash, denial of service, or potentially arbitrary code execution if the overwritten memory is exploited.

FFmpeg is affected, specifically the FFmpeg 9.0.2 release and earlier versions that contain the unfixed integer overflow in the VVC decoder.

The CVSS score of 7.3 marks this flaw as high severity. EPSS is not available, so the precise exploitation probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is supply of a malicious VVC file to a system that decodes video, which could be achieved locally or remotely if the system accepts media from untrusted sources.