The vulnerability is an out‑of‑bounds read in SGI encoder's encode_frame() in libavcodec/sgienc.c when unsigned size variables mishandle negative linesize frames. This allows an attacker to supply a video that triggers autorotate vflip, causing transcoding to SGI images to read pixel data outside the frame bounds and crash the process. The primary impact is a denial of service through application crash, and the out‑of‑bounds read may also expose sensitive memory contents, though no explicit exploitation beyond crash is documented.

FFmpeg, versions up to and including 9.0.2. The affected component is the SGI encoder in libavcodec. Users running FFmpeg 9.0.2 or older should be aware of the risk.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, so exploitation likelihood remains uncertain. The vulnerability is not listed in CISA KEV. An attacker can exploit it by supplying a crafted video file to an FFmpeg instance when transcoding, potentially in a media server or batch process. The attack vector is inferred to involve unauthenticated input of a malicious video; no privilege escalation is required beyond executing the transcoding operation.