A high severity integer overflow vulnerability in FFmpeg allows remote, unauthenticated attackers to crash affected systems by supplying malicious input.

This is an integer overflow flaw located in the target_sws_fuzzer function within libswscale/output.c. The vulnerability is network-exploitable by an unauthenticated attacker, as indicated by the CVSS vector AV:N/AC:L/PR:N.

The ability for an unauthenticated attacker to cause a denial of service poses a significant risk to operational availability. While the vulnerability does not directly result in data theft, the resulting service disruption can halt critical multimedia processing pipelines and lead to system instability, justifying the 7.5 CVSS score.

Immediate Action: Monitor the official FFmpeg project tracker for the release of a patched version and apply updates immediately upon availability.

Proactive Monitoring: Review system and application logs for unusual input patterns or unexpected service crashes that may indicate exploitation attempts.

Compensating Controls: Implement input validation mechanisms and restrict access to FFmpeg-dependent services to trusted networks to reduce the attack surface.

Public Exploit Available: Unknown

Given the remote, unauthenticated nature of this vulnerability, organizations relying on FFmpeg for high-availability media services should treat this as a priority. Administrators must track the vendor's repository for a fix and prepare for an emergency update cycle to prevent potential service downtime.