FFmpeg through version 9.0.2 contains an uninitialized memory disclosure in the CineForm HD decoder. A crafted CFHD file containing an ImageHeight tag taller than the coded band heights can cause the decoder to use uninitialized bytes from the idwt_tmp buffer. These bytes are then passed through the inverse discrete wavelet transform and appear in the decoded video output, allowing an attacker to read sensitive data that was never intended to be exposed. The vulnerability is scored moderate with CVSS 4.8, indicating that it permits information disclosure but does not compromise integrity or availability.

Any installation using FFmpeg 9.0.2 or any earlier releases is potentially vulnerable. The flaw resides in libavcodec/cfhd.c and affects systems that decode CFHD video streams. Applications that routinely process user‑supplied video—web servers, media players, streaming services—could expose their memory contents if they do not update to a patched FFmpeg build or disable the CFHD format.

Because the flaw is a classic uninitialized memory read, exploitation requires only delivery of a malicious CFHD file to a process running FFmpeg. No elevated privileges or additional network access are needed, so the attack surface is wide. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying no confirmed widespread exploitation yet. However, given the moderate CVSS score and the possibility of leaking arbitrary memory, the risk remains non‑negligible for environments that process arbitrary video input. The most likely attack vector is through a handled media file, making this a client‑side or server‑side vulnerability depending on how the application uses FFmpeg.