FFmpeg contains a vulnerability in the DASH demuxer (libavformat/dashdec.c) that allows an out-of-bounds read when a live DASH manifest is refreshed with a startNumber value lower than the prior refresh. The fragment retrieval function only checks the upper bound before indexing the fragment array, allowing a negative index to be used. An attacker can trigger this by serving a live manifest with a decreasing startNumber, potentially exposing memory contents of the FFmpeg process and allowing information disclosure.

FFmpeg versions released before commit 65b0dab, including any builds that incorporate the libavformat/dashdec.c source file. Affected when handling live DASH manifests on the client side.

The vulnerability carries a CVSS score of 7.2, indicating moderate to high risk. EPSS data is not available and the issue is not listed in the CISA KEV catalog. Exploitation is possible remotely by an attacker controlling a DASH server that supplies a manifest with a decreasing startNumber; no local privilege escalation is required. If successfully triggered, the client can read arbitrary memory, leading to potential data exposure or a crash.