FFmpeg versions prior to 8.1.2 have an IAMF demuxer flaw where the mix_presentation_obu() function allocates memory based on a count_label field before validating the input. An attacker can supply a crafted 17‑byte file that causes an allocation amplification of roughly 126 million bytes for each input byte. The resulting uncontrolled memory usage can exhaust the process’s RAM or trigger an OOM kill, effectively denying service for any application that parses IAMF files.

All FFmpeg releases up to and including 8.1.2 are affected. The issue was fixed in commit 5d7112c, so any version derived from 8.1.3 or later is safe. The vendor is FFmpeg and the weakness is classified as CWE‑770.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. The EPSS score of less than 1% suggests that, as of the latest data, exploitation attempts are rare, and the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack surface is a local file or any context where an attacker can supply a crafted IAMF file to an FFmpeg‑based application, such as media players or encoding tools that automatically probe media files.