The vulnerability is a division‑by‑zero flaw in the ff_sws_init_single_context function in libswscale/utils.c of FFmpeg. A crafted media stream can cause the function to divide by zero, leading the process to crash and resulting in a denial of service. The flaw is a classic CWE‑369 error that permits an attacker to trigger a crash by supplying malformed input to the scaling routine.

Affected product is the FFmpeg multimedia framework, specifically the libswscale scaling component. No explicit vendor or product name is provided beyond FFmpeg itself, and no version ranges are indicated, so any FFmpeg build that includes the ff_sws_init_single_context function is potentially vulnerable until the fix is applied.

The likely attack vector is a malicious media file that forces the scaling pipeline to divide by zero; thus, any instance of FFmpeg that processes user‑supplied content can be targeted remotely if the application is exposed over a network or accepts uploads. Because the flaw causes an immediate crash, it can be leveraged for denial of service without requiring privilege escalation. The EPSS score is <1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating limited published exploitation data. The CVSS score of 6.5 denotes medium severity, though the impact remains a denial of service that could degrade media processing services.