The vulnerability is a double free in FFmpeg's libavcodec/cbs_sei.c, where a stale extension_data pointer is freed twice. This leads to heap memory corruption that can be triggered by a crafted H.264 stream containing a display orientation SEI message followed by payload extension data. An attacker who successfully exploits the double free could potentially execute arbitrary code or crash the application, classified as CWE‑415.

Affected are all FFmpeg releases up to and including version 9.0.2. Systems that embed FFmpeg 9.0.2 or earlier for media decoding or transcoding are at risk. No specific patches are listed in the input, but the upstream project has fixed the issue in later releases.

With a CVSS score of 7.3 the vulnerability carries a high severity rating, yet EPSS data is unavailable and the flaw is not listed in CISA KEV at this time. Exploitation would require an attacker to provide a malicious H.264 payload to a vulnerable instance, making it a remote or local surface depending on how the software is used. The risk remains significant for any service parsing untrusted media.