An integer overflow in FFmpeg's target_sws_fuzzer() function in libswscale/output.c allows an attacker to trigger a crash, resulting in a denial of service. The overflow occurs while processing a crafted input that can be supplied by a client or network traffic. The vulnerability disrupts FFmpeg's operation without granting code execution or elevated privileges.

FFmpeg builds that include the vulnerable target_sws_fuzzer() function. The description does not specify version details, so all releases prior to the patch containing the fixed code are potentially affected.

The CVSS score of 7.5 indicates a high severity. The EPSS score is reported as less than 1%, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Attackers would need only a crafted media or fuzzer input to trigger the crash, likely via a remote client communicating with a service that processes media through FFmpeg.