An integer overflow in the yuv2planeX_8_c() function of libswscale in FFmpeg can be triggered by a crafted video file, leading to a denial of service. The flaw is an integer overflow (CWE-190) that causes the decoding process to crash; based on the description, there is no evidence of privilege escalation or data exposure.

FFmpeg installations that use the libswscale module to convert YUV video streams are affected. The specific vulnerable versions are not listed in the advisory, so all releases before the correction are considered at risk.

Exploitation requires an attacker to supply a malicious video file to the vulnerable process. The EPSS score of <1% indicates a low likelihood of exploitation, and no public exploitation or KEV listing exists. The CVSS score of 7.5 denotes high severity. If exploited, the result is a local or remote crash of the FFmpeg process, leading to service disruption for the application using it.