The vulnerability exists in FFmpeg's DASH demuxer. When a live DASH manifest refreshes with a startNumber lower than the previous refresh, the demuxer calculates a negative sequence number. The fragment retrieval function checks only the upper bound of the fragments array before indexing it, allowing a negative index and causing an out‑of‑bounds read. This flaw permits an attacker or a misconfigured DASH server to retrieve memory contents from the FFmpeg process without executing code or causing a crash directly. The data exposed may include internal process information, possibly leading to further exploitation if the information can be leveraged, but the vulnerability does not grant arbitrary code execution.

FFmpeg builds incorporating libavformat/dashdec.c before the commit that added the fix are affected, specifically any version released prior to the commit referenced in the advisory. These versions process DASH manifests on the client side, so any application or media player using such FFmpeg binaries is at risk.

The CVSS score for this issue is 7.2, placing it in the high‑risk category. The EPSS score is less than 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable remotely by a compromised or malicious DASH server that delivers a manifest with a decreasing startNumber. No local privilege escalation is required and the attack does not involve privileged code execution. The primary consequence is information disclosure via an out‑of‑bounds read, though a crash may also occur as a side effect.