The CVE text claims arbitrary code execution "via creating a crafted AAC file" in libx264. libx264 is an H.264 encoder and never parses AAC or any other container or audio input. The only reference, x

The CVE text claims arbitrary code execution "via creating a crafted AAC file" in libx264. libx264 is an H.264 encoder and never parses AAC or any other container or audio input. The only reference, x264 issue #75, is a LeakSanitizer report from running FFmpeg's configure checks with --enable-libx264: when x264_encoder_open() fails, its fail: path frees the encoder without x264_param_cleanup(), so the copied parameter strings (a few hundred bytes) leak once. There is no out-of-bounds access, no use-after-free and no attacker-controlled data involved. FFmpeg closed the original ticket as invalid and pointed at the leak in libx264. The record was assigned by MITRE with no CNA score; the 9.8 comes from CISA-ADP. Debian rates it unimportant in every suite ("Negligible security impact, usually only used for short-lived processes"), and no x264 commit since the report touches this path, so there is nothing to backport.