An integer overflow occurs in the hScale16To19_c() routine within FFmpeg’s libswscale component when processing image data. The overflow corrupts buffer size calculations, which can cause an application to crash immediately upon receiving a specially crafted image file. The only effect is loss of availability; there is no exposure of confidential data or privilege escalation. This weakness is identified as CWE‑190. Based on the description, the vulnerable state is triggered by an image payload, so the likely attack vector is the delivery of a malformed image to any service that forwards user‑supplied media to FFmpeg.

The flaw resides in the core FFmpeg library, specifically the libswscale scaling routine. Any application or service that links against this library and processes images using the hScale16To19_c() function could be impacted. Because the vulnerability is tied to the version of FFmpeg before the commit that fixed the overflow, all releases older than that commit are potentially at risk. The vendor/product list is generic; the risk applies to any deployment of FFmpeg on Linux, Windows, macOS or embedded platforms.

The CVSS score of 7.5 indicates a high‑severity denial‑of‑service vulnerability. The EPSS score of less than 1 % suggests that current exploitation attempts are rare, but this does not eliminate the possibility of brute‑force or targeted attacks. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the overflow remotely by sending a crafted image over a network protocol that the application accepts, or locally by accessing a file that is processed by the vulnerable routine. Because there is no code‑execution capability, the primary concern is service interruption, which can be catastrophic for high‑traffic image services or media gateways.