The vulnerability is a heap-based buffer overflow in the ff_sws_alphablendaway function of FFmpeg's libswscale module. A specially crafted media file can trigger an out‑of‑bounds write that corrupts heap metadata, causing the process to crash and resulting in a denial of service. The overflow affects availability only and does not compromise confidentiality or integrity.

The fault resides in libswscale’s alphablend.c and is introduced by commit 722a217. Any FFmpeg build that includes this commit or earlier unpatched releases is affected. The vulnerability applies to all environments that compile FFmpeg from source or use binaries containing the vulnerable code. No specific vendors are named, so the impact applies to all users of FFmpeg who have not applied the patch.

Exploitation requires the delivery of a maliciously crafted media file to a running FFmpeg instance. The likely attack vector involves an attacker providing such content to a server or application that decodes media, for example a streaming service, media player, or web application. The CVSS score of 7.5 indicates high severity, while an EPSS score of less than 1% suggests a low probability of exploitation today. This vulnerability is not listed in the CISA KEV catalog. Because the flaw affects only availability, an attacker can interrupt services but cannot read or modify data.