The vulnerability is a heap buffer overflow in av_bprint_finalize() within FFmpeg 8.0.1, caused by improperly handled input that leads to memory corruption. An attacker can supply a crafted media or command string to trigger the overflow, resulting in an application crash and denial of service. The flaw is a classic buffer overflow (CWE-122, CWE-787), allowing loss of application availability but not immediate confidentiality or integrity compromise.

This vulnerability affects the FFmpeg open‑source multimedia framework, specifically version 8.0.1. The affected component is the av_bprint_finalize() function used during packet processing. All deployments using FFmpeg 8.0.1 or earlier unreleased builds that include the same code path are at risk. No other vendors or products are listed, but any system that executes FFmpeg to process media input should assess if version 8.0.1 is in use.

The CVSS score of 7.5 indicates high severity. No EPSS score is available, which makes precise exploitation probability uncertain, but lack of presence in KEV suggests no known active exploits yet. Based on the description, the likely attack vector is local or via malicious input provided to FFmpeg – for example, through a user‑controlled media file. If attackers can influence FFmpeg's input stream, they can trigger the overflow, causing a service interruption.