Description

An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T00:17:27.743Z",
  "pubdate": "2026-08-28T00:17:27.743Z",
  "executiveSummary": "A critical integer overflow vulnerability has been identified within the target_sws_fuzzer() function of the FFmpeg multimedia framework, specifically affecting version N-122528-gdd2976b9e1.\nThe vulnerability originates in the libswscale/output.c file, where improper handling of integer arithmetic during pixel format conversion or scaling operations allows for a buffer size calculation error.\nAn unauthenticated, remote attacker can exploit this flaw by providing a maliciously crafted input file to an application utilizing the affected FFmpeg library.\nSuccessful exploitation results in a Denial of Service (DoS), causing the application to crash due to memory corruption or out-of-bounds access triggered by the overflowed integer value.\nThis vulnerability represents a significant security risk for software reliant on FFmpeg for media processing, as it enables service disruption through malformed data injection. No specific user interaction beyond opening the malicious media file is typically required, making this an effective vector for stability-based attacks.",
  "technicalDetails": "The vulnerability resides in the target_sws_fuzzer() function within libswscale/output.c. The root cause is an integer overflow that occurs during the calculation of buffer offsets or dimensions required for image scaling operations.\nIn the context of the FFmpeg swscale library, integer overflows occur when arithmetic operations exceed the storage capacity of the assigned integer type, leading to a wrap-around condition. When this result is subsequently used to allocate memory or index into a buffer, it causes a mismatch between the allocated memory and the expected data size.\nThe attack flow begins when an attacker supplies a crafted media file containing metadata or pixel dimensions that manipulate the internal state of the swscale component. As the library processes this input, the target_sws_fuzzer() function performs arithmetic calculations on these dimensions to prepare internal buffers. If the values provided are chosen specifically to force an overflow, the resulting integer will be smaller than the actual data being processed.\nOnce the overflow occurs, subsequent operations such as memcpy() or pixel writing loops interpret the corrupted, smaller integer as the safe boundary for operations. This leads to an out-of-bounds write or read. Since the system believes it is writing into a correctly sized buffer, it ignores the lack of bounds checking, resulting in the corruption of adjacent heap or stack memory. This memory corruption typically triggers a SIGSEGV (segmentation fault) or an internal library assertion failure, effectively crashing the process.\nThis vulnerability is particularly concerning in FFmpeg because the swscale library is heavily relied upon by various decoders and encoders for cross-format color space and resolution conversion. The exploitation does not require special privileges or pre-authentication, as the processing of untrusted media is a standard function of most multimedia-handling software. While the primary impact noted is a Denial of Service, the underlying memory corruption primitives associated with heap-based integer overflows can theoretically be weaponized for arbitrary code execution if the memory layout is predictable and an attacker can achieve a controlled write primitive. Currently, the impact is limited to crashing the target application, which effectively disrupts availability in any service utilizing the affected FFmpeg version."
}