Description

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T00:17:27.530Z",
  "pubdate": "2026-08-28T00:17:27.530Z",
  "executiveSummary": "A critical integer overflow vulnerability has been identified within the libswscale/utils.c component of FFmpeg, specifically affecting version N-122528-gdd2976b9e1.\nThis vulnerability is classified as an integer overflow flaw, which can be triggered when the software processes a specially crafted image file.\nSuccessful exploitation of this vulnerability results in a Denial of Service (DoS), potentially leading to application crashes or unresponsive behavior.\nThe vulnerability does not require prior authentication, and the impact is primarily centered on service availability rather than data exfiltration or arbitrary code execution.\nAttackers can leverage this flaw by providing a malicious input file to the FFmpeg processing pipeline, which forces an out-of-bounds calculation during the scaling or color conversion process.\nThe risk is categorized as moderate to high, depending on the exposure of the FFmpeg binary to untrusted user-supplied content.",
  "technicalDetails": "The vulnerability resides in the libswscale/utils.c source file, which is responsible for high-performance image scaling and format conversion within the FFmpeg framework.\nThe root cause of this vulnerability is an integer overflow that occurs during the calculation of buffer sizes or offset values when processing image dimensions or pixel format parameters provided by a crafted input file.\nWhen FFmpeg attempts to allocate memory or iterate through pixel data based on dimensions supplied in the input header, the internal integer arithmetic fails to properly validate the constraints of the input.\nIf the attacker provides dimensions (width or height) that, when multiplied or processed by the internal conversion logic, exceed the capacity of the allocated integer type, an integer wrap-around occurs.\nThis wrap-around results in the allocation of an insufficient buffer size or the calculation of invalid memory addresses.\nThe attack flow begins when the FFmpeg library parses the header of a maliciously crafted image file.\nThe parser consumes the metadata, which contains values engineered to trigger the overflow within the scaling function chain.\nAs libswscale processes these parameters, the flawed arithmetic logic executes, leading to a memory corruption event such as an out-of-bounds write or a heap exhaustion condition.\nThe exploitation does not necessarily require the attacker to have privileged access; if the FFmpeg library is used by a media server or an image processing service, any user capable of uploading or submitting an image file can trigger the failure.\nOnce the overflow is triggered, the process typically encounters an unhandled memory access violation or an illegal operation, which causes the FFmpeg process to terminate unexpectedly, thus achieving a Denial of Service (DoS).\nGiven the nature of libswscale, the issue is deeply embedded in the core image transformation logic, meaning any application linking against this version of the library is susceptible if it processes user-provided inputs without external sandboxing or strict input sanitization."
}