This vulnerability allows an attacker to cause FFmpeg processes to allocate extreme amounts of memory by supplying streams that declare absurd LCEVC enhanced dimensions. The insecure allocation of buffer space before validating the size can lead to out‑of‑memory conditions, potentially crashing the decoding process or exhausting system resources. The weakness is classified as arbitrary memory allocation (CWE‑789).

The affected package is FFmpeg, versions 9.0 through 9.0.2 when compiled with the liblcevc_dec decoder. Users deploying these releases need to be aware that any decoding of H.264, HEVC or VVC streams containing LCEVC payloads may trigger the flaw if the decoder is used.

The CVSS score of 5.7 indicates a moderate severity. No EPSS value is available, and the vulnerability is not listed as a known exploited vulnerability by CISA. Exploitation requires crafting a video stream and feeding it into an FFmpeg instance that performs LCEVC decoding. While the attack surface exists in any application that accepts externally supplied video, no public exploits have been documented yet.