A critical integer overflow vulnerability in the rust-ffmpeg library 0.3.0 can be exploited by an unauthenticated attacker to cause a denial of service or execute arbitrary code.

The flaw resides in the cached method, where dimension parameters that are zero or exceed i32::MAX trigger an unchecked cast. This violation of C function preconditions leads to undefined behavior, allowing unauthenticated attackers to trigger system instability or remote code execution.

The vulnerability carries a CVSS score of 7.5, indicating a high level of risk to system availability and integrity. Successful exploitation could result in complete service disruption for applications relying on this library or provide a gateway for attackers to gain unauthorized control over the host environment.

Immediate Action: Since a specific patch version is currently unknown, users should monitor the official GitHub repository for commit 5ac0527 and subsequent security releases. If possible, restrict input to the affected cached method to prevent the processing of invalid dimension parameters.

Proactive Monitoring: Review application logs for unexpected crashes or error patterns related to media processing modules. Monitor system resource utilization for spikes indicative of denial of service attempts.

Compensating Controls: Implement strict input validation at the application layer to ensure that dimension parameters remain within safe, expected bounds before they are passed to the rust-ffmpeg library.

Public Exploit Available: Unknown.

Given the potential for arbitrary code execution, this vulnerability poses a significant risk to any infrastructure utilizing the affected version of rust-ffmpeg. Organizations should prioritize identifying instances of this library within their software supply chain and apply vendor-provided updates immediately upon availability. In the interim, input sanitization serves as the most effective defense against triggered undefined behavior.