FFmpeg
CVE-2025-63757
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted media to FFmpeg 8.0
-
DeliveryInvoke YA16 output conversion path
-
ExploitTrigger integer overflow in yuv2ya16_X_c_template
-
ExecutionCause out-of-bounds access/crash
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires FFmpeg 8.0 specifically to process attacker-controlled media that drives the libswscale output path for the YA16 (16-bit Y+alpha) pixel format, triggering the integer overflow in yuv2ya16_X_c_template. Limiting factors: the specific pixel-format/scaling conversion must be exercised (not all transcodes hit this code path); only version 8.0 is listed as affected; and per the NVD vector the realistic impact is a crash/denial of service (A:H) with no confidentiality or integrity loss. In interactive desktop use a user must open the crafted file, but automated server-side media processing makes UI effectively unnecessary. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) scores purely on availability impact - this is a denial-of-service (crash) vulnerability, not code execution, despite the 'Buffer Overflow' tag. The network attack vector reflects that FFmpeg frequently processes attacker-supplied media (uploads, streams, transcoding pipelines), but exploitation in practice still requires the affected yuv2ya16 (YA16) pixel-format conversion path in libswscale to be exercised against a crafted input. No EPSS score, KEV listing, or SSVC decision data was provided in the input, so exploitation probability and active-exploitation status cannot be quantified here. There is no CISA KEV entry and no clearly-identified public exploit, so this reads as a real but moderate-priority DoS bug rather than a weaponized threat: high base score driven solely by A:H, with no confidentiality/integrity loss. Note a tension to verify: the tags advertise 'Buffer Overflow' (which could imply memory corruption / integrity impact), yet NVD rates I:N and only A:H - if the integer overflow leads to an out-of-bounds write rather than a mere crash, impact could be understated; confirm with the FFmpeg patch (PR #20698). |
| Exploit ScenarioDerived | An attacker supplies a crafted video/image to an FFmpeg 8.0-based service (e.g., a media transcoding or thumbnailing backend) whose processing path invokes the YA16 output conversion. The integer overflow in yuv2ya16_X_c_template is triggered during scaling/output, crashing the worker process and denying service. No public exploit was identified in the provided data, though a gist reference (labeled as a patch) exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Integer overflow in FFmpeg 8.0's libswscale output path (yuv2ya16_X_c_template in libswscale/output.c) lets attacker-controlled media trigger a crash when the YA16 (16-bit luminance + alpha) pixel format is converted through the scaler, producing a denial-of-service condition rather than code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) scores purely on availability impact, so affected deployments are those that process untrusted media - particularly automated server-side transcoding pipelines - while interactive desktop users would need to open a crafted file. Only FFmpeg 8.0 is listed as affected via CPE; vendor patch data is available but no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Apply the upstream fix from vendor patch data - the correction is tracked in FFmpeg merge request/PR 20698 (https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698), with supporting details in the reference gist https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833 and vendor guidance at https://ffmpeg.org/security.html; note that an exact tagged release version containing the fix is not specified in the provided data, so confirm the patched version from the advisory before upgrading. Where immediate upgrading is not possible, restrict untrusted media from reaching FFmpeg's libswscale YA16 output path - for example by normalizing or rejecting inputs that request 16-bit YA16 conversion in transcoding profiles, or by sanitizing pixel-format negotiation in server-side pipelines - accepting the trade-off that legitimate YA16 workflows will be blocked. As a general containment measure for this availability-only flaw, run media processing in sandboxed, resource-capped workers so an overflow-induced crash cannot take down the primary service, and validate that patches are applied to any bundled FFmpeg shipped inside third-party frameworks.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libswscale is FFmpeg's image scaling and pixel-format conversion library, and yuv2ya16_X_c_template is one of its C template functions responsible for emitting 16-bit YA16 output - a format carrying 16-bit luminance plus 16-bit alpha. The root cause class is CWE-190 (Integer Overflow): size or index arithmetic performed while computing the destination plane/stride for the YA16 conversion can wrap, after which the scaler writes based on a corrupted length or offset. Because the vulnerability sits on a data-driven conversion path, it is reached only when the specific YA16 output pixel-format conversion is exercised during scaling - not every transcode or decode exercises this code path - and the assessed vector limits the realistic consequence to a crash (A:H) with no confidentiality or integrity loss (C:N/I:N/A:H). The CPE cpe:2.3:a:ffmpeg:ffmpeg:8:*:*:*:*:*:*:* pins the affected surface to the 8.x release line, specifically 8.0 as described.
Know when Ffmpeg gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
FFmpeg routinely processes untrusted media unattended (AV:N, UI:N, PR:N); integer overflow yields a crash with no C/I impact, so A:H only.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0.
Executive ViewAI
A flaw in FFmpeg 8.0's libswscale scaler causes the media-processing library to crash when it handles YA16 (16-bit luminance plus alpha) content, giving an attacker a way to repeatedly take down any service that ingests untrusted video. The risk is concentrated in automated, server-side transcoding and media-ingest pipelines rather than end-user workstations, since those systems process hostile files without human review. Because the failure only halts processing - it does not allow code execution or data theft - the business exposure is service availability and pipeline downtime rather than data compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Affected Products (CPE)CVE.org
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
Memory corruption in FFmpeg before 8.1 allows an attacker who can supply a crafted H.264/HEVC media file to corrupt heap
Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
Exploit-DB