Description

An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T00:17:27.317Z",
  "pubdate": "2026-08-28T00:17:27.317Z",
  "executiveSummary": "An integer overflow vulnerability has been identified in the yuv2planeX_8_c function within FFmpeg version N-122528-gdd2976b9e1. This flaw resides in the libswscale component, specifically affecting the video scaling and format conversion processes. The vulnerability allows an unauthenticated, remote attacker to trigger a Denial of Service (DoS) condition by providing a maliciously crafted video file. Successful exploitation leads to abnormal program termination or potential memory corruption, severely impacting the stability of applications relying on the FFmpeg library. As FFmpeg is a critical dependency for numerous multimedia frameworks, media players, and streaming servers, this vulnerability presents a significant risk to systems processing untrusted user-supplied content. Exploitation does not require prior authentication or elevated privileges, as the impact is realized during the standard decoding or conversion lifecycle of the input media file.",
  "technicalDetails": "The vulnerability is localized within the yuv2planeX_8_c function located in the file libswscale/output.c. This function is part of the image scaling subsystem responsible for YUV to RGB/YUV planar conversions. The root cause is an integer overflow occurring during internal arithmetic operations, likely related to pointer arithmetic or buffer indexing based on video dimensions provided within the container format.\nDuring the processing of a crafted video stream, the attacker provides manipulated metadata or pixel data parameters that force the yuv2planeX_8_c logic to perform calculations that exceed the maximum representable value for the allocated integer type. In the context of C-based multimedia libraries, such overflows typically result in wrapping behavior, leading to incorrect buffer offsets or size calculations. When the library subsequently attempts to write processed pixel data to memory, these invalid calculations result in an out-of-bounds write or an access violation.\nThe attack flow proceeds as follows: First, the attacker embeds a malicious payload within the headers or bitstream of a video file designed to trigger the vulnerable scaling path. Second, the target application invokes the FFmpeg library to parse and convert the video file. Third, the yuv2planeX_8_c function is reached during the YUV plane processing. Fourth, the integer overflow occurs due to the crafted input, causing the internal state to become corrupted. Finally, the application crashes as it attempts to process or write data based on the overflowed, invalid index, resulting in a Denial of Service.\nBecause the function operates directly on buffer inputs provided by the user, the vulnerability is reachable without authentication or specific privilege levels, provided the application accepts and parses arbitrary video files. The post-exploitation impact is primarily limited to application instability; however, in certain memory-managed environments, this type of overflow could potentially be leveraged for memory corruption or arbitrary code execution, though it is currently characterized as a DoS vulnerability. The lack of bounds checking on the arithmetic results prior to memory access is the critical failure point that enables this exploit."
}