A critical denial of service vulnerability exists in the rust-ffmpeg library, allowing unauthenticated attackers to crash applications via integer overflow.

The vulnerability is an integer overflow in the Vector::new constructor, which occurs due to an unchecked cast of a usize parameter to c_int. This flaw allows an unauthenticated attacker to trigger a null pointer dereference in the underlying sws_allocVec function.

The exploitation of this vulnerability results in a denial of service, which can cause significant disruption to applications relying on rust-ffmpeg for media processing. With a CVSS score of 7.5, the risk is elevated because the attack vector is network-based and requires no authentication, potentially impacting system availability and service continuity.

Immediate Action: Review the project repository for official patches or updates addressing the integer overflow in Vector::new. If no official release is available, evaluate the feasibility of applying the upstream fix directly to the local source code.

Proactive Monitoring: Monitor application logs for unexpected crashes or service restarts that may indicate attempts to trigger the null pointer dereference.

Compensating Controls: Implement input validation to restrict the size of parameters passed to media processing functions, as a temporary measure to mitigate potential overflow conditions.

Public Exploit Available: Unknown

Given the potential for denial of service and the existence of a proof-of-concept, administrators should treat this vulnerability with high priority. Monitor the rust-ffmpeg repository for the release of a stable, patched version and apply it immediately upon availability to ensure system stability.