FFmpeg releases through version 9.0.2 contain a flaw in the old_codec23() function of the libavcodec/sanm.c module, which fails to properly initialize stack memory. When the decoder processes a specially crafted LucasArts SMUSH/SANM animation that utilizes codec 23 with an inline table, stack bytes are copied into the decoded video frames, inadvertently exposing data that was present on the decoder’s process stack. This information exposure is classified under CWE-908 and can reveal sensitive memory contents such as cryptographic keys, passwords or other confidential data that an attacker may reconstruct from the leaked frames.

All users of the FFmpeg library where the software is compiled from source or otherwise distributed in versions up through 9.0.2. The vulnerability is limited to the FFmpeg product itself; no third‑party extensions are referenced in the advisory. Users should verify the version of FFmpeg they are running and ensure it is not one of the affected releases.

The NIST CVSS score of 4.8 indicates a moderate severity impact. While an EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likely attack vector is the delivery of a malicious video file to the FFmpeg decoder from an untrusted source. An attacker can simply supply the crafted SMUSH/SANM animation to any system that decodes such files, causing the stack data to be embedded in the output and potentially captured or examined by the user or an external observer. Because the vulnerability does not require elevated privileges, compromise is possible in a wide range of environments, including media processing pipelines, content delivery services, and any applications that invoke FFmpeg to decode user‑supplied video content.