FFmpeg libraries from versions 4.4 through 8.1.2 contain an out‑of‑bounds memory access flaw in the ADX audio decoder. A crafted ADX or AAX file that changes the channel layout mid‑stream triggers the decoder to re‑parse a stream header via AV_PKT_DATA_NEW_EXTRADATA while failing to update its internal channel count, allowing subsequent decode operations to index the prev[] state array with a stale channel count. This results in out‑of‑bounds read and write operations (CWE‑125 and CWE‑787) that can corrupt memory, cause application crashes, or in worst cases lead to arbitrary code execution depending on the execution context.

Based on the vendor/product and CPE information, it is inferred that all builds of the FFmpeg FFmpeg library from version 4.4 to 8.1.2 are affected. Any application, media player, transcoding service, streaming server, or embedded device that links against these releases and decodes ADX or AAX audio streams is potentially vulnerable.

Based on the description, the likely attack vector is the delivery of a malicious ADX or AAX audio file. The vulnerability has a CVSS score of 8.7, indicating high severity, while the EPSS score is less than 1 %, suggesting a low likelihood of active exploitation currently. It is not listed in CISA KEV, so no publicly known exploits exist. If exploited, memory corruption may cause a crash or application compromise depending on the environment.