The vulnerability is a signed integer overflow in the media format parser of FFmpeg before version 9.0. During the parsing of a HEIF ispe box, 32‑bit unsigned width and height values are copied into signed integer fields without proper bounds checking. Large values that exceed INT_MAX become negative, and when these are accumulated in later processing, the signed addition overflows. On x86‑64 processors the overflow wraps to a small positive number, bypassing subsequent validity checks and allowing an attacker to manipulate the parsing process. The weakness is classified as CWE‑190, reflecting improper integer conversion. This flaw could be exploited to cause a crash or, depending on FFmpeg's downstream usage, to inject malformed data that may lead to further control‑flow violations.

FFmpeg, the open‑source multimedia framework, is affected by this issue in all releases preceding 9.0. The vendor's fix is available in commit 059eb2e853, which updates mov.c to correctly validate sizes before they are stored. Systems that frequently process HEIF or other media files using FFmpeg must therefore consider the impact of this integer overflow on the integrity of parsing procedures.

The CVSS score of 6.9 indicates a moderate severity; the EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The flaw is exploitable when an attacker can provide a crafted HEIF file to the FFmpeg library, which is typical for local user input or for services that decode media from untrusted sources. Although no publicly disclosed exploit currently exists, the overflow leads to undefined behavior that could be leveraged to crash the application or potentially produce arbitrary memory writes, especially on platforms with less defensive overflow handling.