The vulnerability is an integer overflow (CWE‑190) in FFmpeg's libavfilter/vf_scale.c component. A crafted video frame triggers overflow during scaling calculations, leading to a crash or uncontrolled resource consumption that interrupts the service. This results in a denial of service for any application or service that uses FFmpeg to process media.

All FFmpeg installations that employ the legacy libavfilter/vf_scale.c implementation are affected. No specific release series is listed in the advisory, so any FFmpeg build containing the vulnerable code before the patch is at risk. Administrators should verify whether their FFmpeg binary includes the insecure scaling filter, as version information is not provided.

The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the CVSS score of 6.5 reflects a moderate risk because an attacker who can supply a malicious video to the FFmpeg process can trigger a crash or excessive resource use. Based on the description, it is inferred that the attack vector is the receipt of untrusted media input to the scaling filter. Exploitation requires the attacker to control the content of a video file processed by a vulnerable FFmpeg instance, which is typical of media servers, transcoding pipelines, or any software that accepts arbitrary video from external sources.