Description

An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T00:17:27.630Z",
  "pubdate": "2026-08-28T00:17:27.630Z",
  "executiveSummary": "A critical integer overflow vulnerability has been identified within the hScale16To19_c() function of the FFmpeg multimedia framework (version N-122528-gdd2976b9e1).\nThis vulnerability originates from improper arithmetic validation when processing image data, allowing a remote attacker to trigger memory corruption or logic errors through a maliciously crafted image file.\nThe primary security impact is a Denial of Service (DoS), where the application process terminates unexpectedly upon encountering the malformed payload.\nThis flaw affects the libswscale library, specifically within the output.c component responsible for image scaling and pixel format conversion.\nExploitation requires no authentication or high-level privileges; the attacker merely needs to provide a payload that the FFmpeg-based application attempts to decode or transcode.\nGiven the ubiquitous nature of FFmpeg in media processing pipelines, web browsers, and media players, this vulnerability poses significant stability risks to systems processing untrusted user-supplied content.",
  "technicalDetails": "The vulnerability resides in the hScale16To19_c() function located in libswscale/output.c. This function is tasked with scaling 16-bit pixel data to 19-bit representations during the color space conversion or resizing process.\nThe root cause is an integer overflow that occurs during the calculation of buffer sizes or pixel offsets. When the input dimensions or scaling factors within the image header are manipulated, the arithmetic operations involved in calculating the output stride or destination buffer offset exceed the maximum value representable by the integer type utilized in the calculation.\nThe attack flow begins when an attacker provides a crafted image file containing specific metadata (such as width, height, or scaling coefficients) that forces the hScale16To19_c() function to perform arithmetic operations that wrap around. Because the resulting value is subsequently used to define memory access boundaries or index into heap buffers, the overflow triggers an out-of-bounds access or a logic error.\nIn a standard execution flow, libswscale attempts to allocate or write into a destination buffer based on these tainted calculations. The integer wrap-around leads to a significantly smaller buffer allocation than required or an erroneous pointer calculation, resulting in a heap-based buffer overflow or a segmentation fault when the application attempts to write pixel data.\nThis behavior results in immediate process termination (DoS) as the memory management unit or the application's internal integrity checks identify the illegal access. Because the overflow is triggered during the image processing routine, the vulnerability is reachable through any FFmpeg-based interface that supports image decoding or conversion.\nNo specific privileges are required to reach the vulnerable code path; the attacker's sole requirement is the ability to submit an image file to an application that utilizes the affected version of FFmpeg.\nWhile the primary impact described is a Denial of Service, integer overflows in memory-management-critical functions like those in libswscale often present a potential vector for arbitrary code execution if the overflow can be leveraged to overwrite adjacent heap metadata or function pointers. However, in the context of this specific report, the vulnerability is characterized by its ability to cause system instability and service disruption."
}