The vulnerability is a use‑after‑free in FFmpeg’s MJPEG decoding path. In libavcodec/mjpegdec.c, an attacker can send a JPEG stream that contains a SOF marker without the required SOI marker. The decoder then passes a stale raw_image_buffer pointer to hardware accelerators such as NVDEC, causing the application to read freed memory. The result is either a crash that can be triggered by any client providing a malicious stream, or an accidental disclosure of heap contents that may contain sensitive data used by the caller.

Affected products are FFmpeg software versions up to and including 9.0.2. The issue is present in the default build that enables hardware‑accelerated MJPEG decoding. All users deploying FFmpeg 9.0.2 or earlier for decoding MJPEG data are potentially vulnerable. No specific sub‑releases are excluded unless the vendor explicitly back‑ported the fix.

The CVSS score of 5.8 reflects a moderate severity combined with the lack of remote code execution. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation so far. An attacker requires the ability to supply a crafted MJPEG stream to the ffmpeg decoder, which is a realistic scenario for media servers or any service that accepts user video input. The attack could cause denial of service or leak heap data, but it would not directly grant code execution.