The vulnerability is an unvalidated division by zero in dovi_configure_ext() within the dovi_rpuenc.c module. When the frame rate denominator supplied in a HEVC or AV1 bitstream is zero, the code performs a division by the zero value, causing the entire FFmpeg process to terminate. This results in a denial‑of‑service condition for any application that invokes FFmpeg to decode, encode or transcode such a bitstream. The weakness is a classic arithmetic error (CWE‑369).

The issue affects FFmpeg releases up to and including version 9.0.2. Any installation of FFmpeg 9.0.2 or earlier that processes HEVC or AV1 streams using the dovi_rpu bit‑stream filter, or that relies on libx265, libaom, or libsvtav1 encoders, is vulnerable. Systems that use the dovi_rpu filter with a non‑zero frame‑rate numerator and a zero denominator are at risk.

The CVSS score of 5.7 indicates moderate impact; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a crafted media file that contains an invalid frame‑rate denominator, which can be done locally or from the network if the system decodes user‑provided files. Because the flaw only triggers a crash and does not lead to arbitrary code execution, the likelihood of exploitation is limited to denial‑of‑service scenarios. Nevertheless, any organization that relies on FFmpeg for media processing should assess exposure and apply the fix promptly.