FFmpeg contains a null pointer dereference in the get_min_buffer_size function, which can be triggered by a carefully crafted video file. When this function is called, the pointer dereference results in a crash of the process handling the video, causing a service outage. The weakness is a classic null pointer dereference that compromises the integrity of the media processing pipeline and leads to availability loss for any application relying on FFmpeg.

Any system that incorporates the FFmpeg library—common in media servers, streaming services, video transcoding tools, and embedded devices—may be affected, regardless of the application layer. The vulnerability exists in the swscale component of FFmpeg, but no specific version range is listed, so users should verify whether they are running unpatched contributors prior to the issue’s resolution.

The CVSS score is 5.0, reflecting medium severity. The EPSS score is <1% (0.00149) and the vulnerability is not listed in CISA’s KEV catalog, indicating no current evidence of widespread exploitation. Still, the CVE describes a remote denial of service scenario via a crafted video file; the likely attack vector therefore requires the ability to deliver a malicious file to an environment that processes media with the vulnerable FFmpeg build. Consequently, if an application accepts user‑supplied video without validating its format, the DoS can be achieved with moderate effort. The absence of a public exploit does not reduce the need for mitigation, as a local denial of service can be extremely disruptive in high‑availability contexts.