The vulnerability resides in the vf_floodfill video filter of FFmpeg. When an attacker supplies a dynamically sized video stream and disables filtergraph reinitialization with the -reinit_filter 0 option, the filter_frame() routine pushes flood‑fill neighbor entries beyond the stack initially allocated for the original frame dimensions. This results in an out-of-bounds write that corrupts heap memory, causing the process to crash and potentially allowing arbitrary code execution if the heap layout is favorable and the process is not hardened.

FFmpeg versions 3.4 through 8.1.2 are affected. The vulnerability is tied to the FFmpeg:FFmpeg product line as documented by the CNA.

The CVSS score is 7.3 and the EPSS score indicates less than 1% chance of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be able to supply a crafted video stream to an instance of ffmpeg, which may be local or exposed to remote clients via media‑processing services. Given the low exploitation probability and the requirement for specialized input, the risk to any particular system is moderate but non‑negligible if the application runs with elevated privileges or is accessible over a network.