CVE-2025-63757

Executive Summary

CVE-2025-63757 is an integer overflow vulnerability discovered in the yuv2ya16_X_c_template function within the libswscale/output.c file of FFmpeg 8.0. This flaw occurs during the conversion of YUV pixel data to the YA16 (16-bit grayscale with alpha) format. An integer overflow can lead to a buffer under-allocation or out-of-bounds write, potentially allowing an attacker to corrupt memory and achieve arbitrary code execution or cause a denial of service. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound). As of this report, no official patch has been released, and no public exploit code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for systems using FFmpeg for media processing.

Supply Chain & Package Security

FFmpeg is a widely used multimedia framework integrated into numerous applications, media players, video editors, and streaming services. This vulnerability affects the core library, meaning any software that statically or dynamically links to FFmpeg 8.0 is potentially vulnerable. Supply chain risk is elevated because the vulnerable function is in the libswscale library, which is commonly used for pixel format conversion. Organizations should audit their software dependencies for FFmpeg 8.0 and consider using alternative media processing libraries or applying vendor-specific patches if available.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local – Exploitation requires local access to the system or a crafted media file.
• Attack Complexity (AC): Low – The overflow is triggered by a specific input, but no special conditions are needed.
• Privileges Required (PR): None – No authentication required.
• User Interaction (UI): Required – The victim must open or process a malicious media file.
• Scope (S): Unchanged – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High – Memory corruption could leak sensitive data.
• Integrity (I): High – Arbitrary code execution could modify data.
• Availability (A): High – Denial of service is possible.

Threat Level: High – Although no public exploit exists, the integer overflow in a widely used library poses a significant risk to media processing pipelines.

Deep Dive & Mechanics

The vulnerability resides in the yuv2ya16_X_c_template function in libswscale/output.c. This function is responsible for converting YUV pixel data to the YA16 format, which stores 16-bit grayscale (Y) and alpha (A) components. The integer overflow occurs during the calculation of buffer sizes or offsets when processing pixel data.

Root Cause: The function likely uses an arithmetic operation such as width * height * bytes_per_pixel to allocate memory or compute offsets. If the width and height values are large (e.g., from a crafted video file), the multiplication can overflow a 32-bit integer, resulting in a small or negative value. This leads to an undersized buffer allocation, and subsequent writes to that buffer cause out-of-bounds memory corruption.

Trigger: An attacker can craft a media file (e.g., a video with extreme resolution dimensions) that, when processed by FFmpeg, triggers the overflow in the YA16 conversion path. The vulnerability is triggered during the scaling or pixel format conversion process.

Impact: Successful exploitation could allow an attacker to overwrite adjacent memory, potentially leading to arbitrary code execution in the context of the FFmpeg process. This could be used to compromise a server or user system that processes media files.

Vulnerable vs. Patched Code

Since no official patch is available, we can only hypothesize the fix. The vulnerable code likely looks like:

// Vulnerable code (hypothetical)
int size = width * height * 4; // 4 bytes per pixel for YA16
uint8_t *buffer = av_malloc(size);

The patched code would include overflow checks:

// Patched code (hypothetical)
int size;
if (av_size_mult(width, height, &size) < 0 || av_size_mult(size, 4, &size) < 0) {
    // Handle overflow error
    return AVERROR(ENOMEM);
}
uint8_t *buffer = av_malloc(size);

The fix uses safe multiplication functions (e.g., av_size_mult) that detect overflow and return an error.

Exploitation & Lab Setup

Red Team

Prerequisites:

• FFmpeg 8.0 installed on a target system.
• Ability to deliver a crafted media file to the target (e.g., via email, web upload, or network share).

Exploitation Steps:

1. Create a malicious video file with extreme resolution dimensions (e.g., 65536x65536) and a pixel format that triggers the YA16 conversion path.
2. Use a tool like ffmpeg to convert the file: ffmpeg -i malicious.mkv -pix_fmt ya16le output.mkv
3. The integer overflow causes a buffer under-allocation, leading to a crash or potential code execution.

Note: No public exploit code is available. This is a theoretical exploitation path.

Blue Team

Detection:

• Monitor for FFmpeg crashes or abnormal memory usage when processing media files.
• Use memory corruption detection tools (e.g., AddressSanitizer) during testing.
• Implement file size and resolution limits in media processing pipelines.

Hunting:

• Search for logs containing FFmpeg error messages like "out of memory" or "invalid argument".
• Analyze network traffic for unusually large media files being transferred.

Indicators of Compromise (IOCs)

• File Hashes: (None available, but crafted files may have specific patterns)
• Network Indicators: Unusually large media files (e.g., > 10 GB) with extreme resolution metadata.
• System Indicators: FFmpeg process crashes with segmentation faults or out-of-memory errors.
• Registry/File System: Modified FFmpeg binaries or libraries (if exploitation leads to persistence).

Detection Engineering

YARA Rule

rule CVE_2025_63757_FFmpeg_Integer_Overflow {
    meta:
        description = "Detects crafted media files targeting CVE-2025-63757 integer overflow in FFmpeg"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63757"
    strings:
        $yuv2ya16 = "yuv2ya16_X_c_template" ascii wide nocase
        $ya16 = "ya16" ascii wide nocase
        $overflow_pattern = { 00 00 00 00 00 00 00 00 } // Placeholder for overflow trigger
    condition:
        $yuv2ya16 or ($ya16 and #overflow_pattern > 5)
}

Sigma Rule

title: FFmpeg Integer Overflow Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2025-63757 via abnormal FFmpeg process behavior
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ffmpeg.exe'
        CommandLine|contains: 'ya16'
    condition: selection
falsepositives:
    - Legitimate use of YA16 pixel format with normal resolutions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-63757 FFmpeg Integer Overflow - Large Media File Transfer"; flow:to_server; content:"Content-Type|3a| video/"; nocase; pcre:"/^Content-Length:\s*\d{9,}/mi"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply vendor patches as soon as they are released. Monitor the FFmpeg security page for updates.
2. Workaround: Disable YA16 pixel format conversion if not needed, or use a different pixel format.
3. Input Validation: Implement strict validation of media file dimensions and pixel formats before processing.
4. Sandboxing: Run FFmpeg in a sandboxed environment with limited privileges.
5. Update: Upgrade to a patched version of FFmpeg when available (e.g., 8.1 or later).
6. Monitoring: Deploy detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.

Valters IT