An integer overflow occurs in the yuv2planeX_8_c function within FFmpeg's libswscale module, allowing a crafted video to trigger memory corruption that can crash the decoding process. The resulting loss of service is limited to the process using FFmpeg, with no evidence of privilege escalation or data exposure caused by the flaw. The weakness is identified as an integer overflow vulnerability (CWE‑190).

FFmpeg is an open‑source multimedia framework widely used in media players, streaming servers, and web browsers. Any installation that relies on FFmpeg for decoding or converting YUV video streams can be affected. The specific affected versions are not enumerated in the advisory, so all releases predating a patch that eliminates the overflow are considered vulnerable.

The exploit requires that an attacker supply a specially crafted video file processed by the vulnerable FFmpeg function. While no public exploitation data or KEV listing exists, the lack of an EPSS score suggests low to moderate exploit probability for the general audience. Systems that decode untrusted media are at risk, and an attacker could initiate a denial of service by repeatedly sending malicious files, potentially exhausting system resources.