An integer overflow in the cbs_jpeg_write_scan() function of FFmpeg results in a heap buffer overflow on 32‑bit builds. When an attacker supplies a crafted MJPEG or JPEG stream that includes a scan 512 MiB or larger, the overflow can corrupt heap memory or cause the application to crash.

FFmpeg, version 9.0.2 or earlier on 32‑bit architectures.

The CVSS score is 7.3, indicating high severity. No EPSS information is available and the issue is not listed in CISA KEV, suggesting that exploitation is possible but not yet widely observed. Attackers can exploit the flaw by delivering a malicious MJPEG/JPEG stream to any component that uses CBS bitstream filters such as filter_units, which invoke cbs_jpeg_write_scan(). The vulnerability may lead to memory corruption, application crashes, and potentially denial of service if an attacker can influence process control after the overflow.