FFmpeg’s vf_hqdn3d filter performs an out‑of‑bounds write on the heap when filtergraph reinitialization is disabled. The vulnerability is triggered by a video whose frame width increases between frames; the filter's config_input() routine allocates per‑plane line‑history buffers based on an initial, smaller width, and subsequent larger frames cause the denoise_spatial() routine to write past the allocated boundary, corrupting heap memory. This corruption can lead to arbitrary code execution or a crash, depending on the system context. The weakness is a classic out‑of‑bounds heap write (CWE‑122).

FFmpeg, all builds prior to the patch commit 5d7112c, including version 8.1.2. The vulnerability applies to any deployment that uses the vf_hqdn3d filter with the -reinit_filter 0 option disabled. No other sub‑products or components are singled out.

The CVSS score of 7.7 places the issue in the high severity range, yet the EPSS score of <1% indicates that exploitation is unlikely at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply a malicious video stream to a vulnerable FFmpeg instance and to use the –reinit_filter 0 flag. If achieved, the attacker could cause arbitrary memory corruption that may lead to code execution or denial of service. The attack vector is local to the instance that processes the crafted video, so protecting incoming media or applying the fix mitigates the threat.