FFmpeg 3.0 through 8.x contain a flaw in the native RSCC decoder that reads uninitialized heap memory during frame decoding. When a crafted video file contains compressed tiles that decompress fewer bytes than claimed by their geometry, the decoder copies the unwritten suffix of an intermediate buffer into the output frame. The result is that data from previous heap allocations or earlier decoded frames can be exposed, potentially leaking sensitive information. The weakness is classified as CWE-908.

All FFmpeg installations using the native RSCC decoder between version 3.0 and before 9.0 are vulnerable. The specific product affected is the FFmpeg multimedia framework. Versions 3.0, 3.1, …, 8.99 are all susceptible; upgrading to 9.0 or later removes the susceptible decoder implementation.

The CVSS score of 6.8 indicates a medium to high risk level, primarily due to the potential exposure of information without reliable integrity or availability impacts. EPSS data is not available, so the likelihood of exploitation cannot be quantified from public data. The vulnerability can be exploited by anyone able to supply a crafted video file to a service that uses the vulnerable FFmpeg decoder, such as media players, streaming servers, or any application that accepts arbitrary video input. It is not a remote code execution flaw, but the disclosed data could be leveraged in further attacks if it contains cryptographic keys, credentials, or other sensitive data.