The vulnerability is a use‑after‑free in FFmpeg's NVDEC decoder, triggered when ff_nvdec_start_frame() fails to reset the bitstream pointer after a slice error. Crafting a video that abandons a picture before the end‑frame causes cuvidDecodePicture() to read freed heap memory. The result can be a crash or exposure of stale heap contents, leading to denial of service or information disclosure.

FFmpeg 9.0.2 and earlier releases. The issue affects builds that enable NVIDIA NVDEC hardware acceleration, which is present in most FFmpeg distributions compiled with NVIDIA support.

The CVSS score of 5.8 indicates moderate severity. EPSS data is currently unavailable, so the likelihood of exploitation is not quantified; however, the vulnerability is not listed in CISA's KEV catalog. Because the flaw is triggered by supplying a malicious video, an attacker would need the ability to feed crafted media to the vulnerable FFmpeg process. If the application runs with local or network‑exposed media input, the attacker could execute the exploit remotely or locally, depending on how the media is provided. The crash or information leak would affect the application process and potentially the environment in which it runs.