FFmpeg versions up to 9.0.2 contain a memory leak in the VAAPI decoder module. By feeding specially crafted H.264 or other VAAPI‑decoded streams that trigger slice parse errors on each frame, an attacker can cause continuous allocation of VA parameter, slice, driver and heap memory. The leak persists while the stream is processed, potentially exhausting system memory and triggering a crash or severe slowdown of the affected FFmpeg instance. This flaw does not directly grant code execution or data disclosure, but it facilitates a denial‑of‑service attack by exhausting available memory.

The vulnerability affects the FFmpeg project, specifically all releases up to and including 9.0.2. Any system running an affected version of FFmpeg and using VAAPI decoding for video streams is at risk. No additional vendor or product variants are mentioned beyond FFmpeg itself.

The CVSS score of 5.7 classifies this issue as Medium severity. EPSS information is currently unavailable, therefore the quantified likelihood of exploitation cannot be determined. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by providing malicious video streams to the decoder; the attack can be performed by anyone who can supply such streams, whether from a local file or a remote source. Successful exploitation leads to progressive memory consumption that may terminate the FFmpeg process and disrupt related services.