The vulnerability resides in the native Screenpresso decoder within FFmpeg (libavcodec/screenpresso.c). When a crafted SPV1 packet containing a valid zlib stream that decompresses fewer bytes than the full frame requires is processed, the screenpresso_decode_frame() function does not validate the number of decompressed bytes before invoking av_image_copy_plane() to copy the entire frame from a persistent buffer. This oversight allows unwritten heap memory from prior allocations or frames to be copied into the decoded output, potentially exposing sensitive data, including userspace addresses and other confidential information.

Affected products include the FFmpeg library released under the name FFmpeg. Versions from 3.0 up to, but not including, 9.0 are vulnerable. Any deployment that incorporates these FFmpeg releases and employs the Screenpresso decoder for media handling is at risk. Version information for affected releases can be found in the vendor documentation and the referenced commits that address this issue.

The CVSS score of 6.8 indicates a moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited evidence of exploitation in the wild. The likely attack vector is through delivery of a malicious SPV1 packet to a system that processes media via the vulnerable decoder, which could be remote if the application accepts external video streams or local if the attacker can inject data into the decoder's input pipeline. Because the flaw involves reading uninitialized heap memory, the impact is information disclosure rather than privilege escalation or denial of service.