FFmpeg versions up to 9.0.2 contain an uncontrolled resource consumption flaw in the JPEG XL parser. The parse_frame_header() function fails to verify the table of contents (TOC) entry count against the remaining input, allowing an attacker to supply a malformed frame header with a huge toc_count. This causes the parser to loop for an extended period and exhaust CPU cycles. The weakness is identified as CWE-606, representing a logic error in input validation. The resulting impact is degraded performance and potential denial of service for services relying on FFmpeg.

FFmpeg, version 9.0.2 and earlier, is affected. Users of FFmpeg 9.0.2 or earlier must check their installed version and upgrade if it matches the affected releases.

The CVSS score is 6.8, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is supplying a malicious JPEG XL file to a vulnerable FFmpeg instance; an attacker can trigger the CPU exhaustion by crafting a frame header with an oversized TOC count. Given that the flaw resides in the parsing routine, the vulnerability can be exploited remotely by feeding crafted media to applications that invoke FFmpeg for decoding.