The hScale16To19_c() function in FFmpeg’s libswscale converts 16‑bit YUV images to a 19‑bit format. An attacker can supply a specially crafted image that causes an integer overflow in this routine, leading to incorrect buffer calculations and a crash of the FFmpeg process. The flaw does not provide code execution or compromise data confidentiality, but it does interrupt the service that relies on FFmpeg, resulting in a denial of service.

The vulnerability resides in the FFmpeg library, specifically the libswscale component. Any software that links against FFmpeg and processes images using the vulnerable hScale16To19_c() routine is affected. The exact version range is not specified, but the issue references a commit (gdd2976b9e1) that predates the patch, so all releases prior to the fix are potentially at risk.

The CVSS score is not publicly documented and the EPSS score is unavailable, but the attack surface is relatively high for applications that consume image data. An adversary can trigger the overflow by presenting a malicious image, which may be done remotely if the target service accepts external media or locally if a user can place a crafted file. The result is a local or remote service disruption. Because the flaw is a straightforward DoS, widespread exploitation is possible in high‑traffic image processing services or media servers that rely on FFmpeg without additional isolation measures. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is not yet actively exploited at scale.