FFmpeg up to version 9.0.2 contains a division by zero bug in the VVC decoder. The routine ff_vvc_slice_rpl() does not validate the number of active reference indices against the reference list, allowing an attacker to craft a VVC bitstream with excessive indices. When processed, ff_vvc_mv_scale() can calculate a zero POC difference, which causes a division by zero and crashes the decoder. The result is a denial of service that disrupts playback or processing of media streams but does not provide privilege escalation or direct code execution.

This flaw affects the FFmpeg project, specifically the ffmpeg binary that includes the libavcodec VVC decoder. All releases up to and including version 9.0.2 are vulnerable. The issue does not apply to later FFmpeg releases that have updated the reference index validation logic.

With a CVSS score of 6.8 the vulnerability is considered moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that exploitation is unlikely to be widely used yet. The attack requires an attacker to deliver a crafted VVC stream to a vulnerable system that invokes the decoder; this can be achieved either through local media processing or remotely by exploiting an application that automatically decodes user-supplied VVC content. Since the flaw results only in a crash, there is no direct code execution or data leakage, but the denial of service can be significant for service‑dependent environments.