The vulnerability is an out-of-bounds heap write in the GoPro CineForm HD (CFHD) decoder within FFmpeg. The flaw occurs while processing AVI files during stream probing. An attacker can supply a crafted AVI file that forces the cfhd_decode() function to bypass a logical output‑width check, causing horiz_filter_clip() to write beyond the bounds of the output frame buffer. This memory corruption can overwrite a live cleanup callback pointer and enable the attacker to execute arbitrary code on the host with the privileges of the FFmpeg process.

Affected are FFmpeg releases 4.4 through 8.x. Any installation of FFmpeg within that range that decodes AVI streams using the CFHD decoder is vulnerable. Versions 9.0 and later contain the fix, so systems running newer versions are not impacted. The vulnerability is triggered only when a malicious AVI file is parsed during probing.

The CVSS score of 8.5 indicates a high severity, and although no EPSS data is available, the lack of a KEV listing suggests limited public exploitation to date; however, the mechanism can be remotely triggered by delivering a crafted AVI file to an application that uses FFmpeg for stream probing. Because the flaw enables arbitrary code execution, any attacker who can feed a malicious stream to the vulnerable process can gain full control of the system. The attack requires no additional privileges beyond those of the application using FFmpeg.