An off‑by‑one heap overflow occurs in the function get_exponent_dynamic() in libavcodec/nellymoserenc.c. When an attacker supplies a crafted audio stream to a program that encodes Nellymoser with trellis enabled, the internal variable idx can equal OPT_SIZE, causing the code to write one element past the opt and path allocations. This memory corruption can lead to crashes or, if an attacker can control the overwritten data, arbitrary code execution. The vulnerability is classified as an object or buffer off‑by‑one error (CWE‑193).

FFmpeg and related FFmpeg‑based media processing applications running FFmpeg version 9.0.2 or earlier are affected. Applications that invoke the Nellymoser encoder with trellis support are vulnerable, regardless of the host operating system.

The CVSS score of 7.3 indicates a moderate‑to‑high severity risk. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply crafted audio to a processing component; therefore, the attack vector is likely local or remote, depending on the deployment of the media application. If the attacker succeeds, the impact could include application crashes and potential arbitrary code execution on the system running FFmpeg.