CVE-2026-38343: FFmpeg Integer Overflow DoS Vulnerability

CVE-2026-38343 Overview

CVE-2026-38343 is an integer overflow vulnerability [CWE-190] in the libavfilter/vf_scale.c component of FFmpeg build N-122528-gdd2976b9e1. An attacker can trigger the flaw by supplying a crafted video file to a vulnerable FFmpeg instance. Successful exploitation causes a Denial of Service (DoS) condition in the affected process. The vulnerability requires user interaction to open or process the malicious media file, and it does not expose confidentiality or integrity of data. FFmpeg is embedded in many media players, transcoding services, and streaming pipelines, which broadens the exposure surface for this issue.

Critical Impact
Processing a crafted video file through the vulnerable scale filter causes a Denial of Service that disrupts media processing pipelines and transcoding workloads.

Affected Products

FFmpeg build N-122528-gdd2976b9e1
Applications that link against the vulnerable FFmpeg libavfilter library
Media transcoding and streaming services that invoke the scale filter on untrusted input

Discovery Timeline

2026-08-28 - CVE-2026-38343 published to the National Vulnerability Database (NVD)
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-38343

Vulnerability Analysis

The defect resides in libavfilter/vf_scale.c, the source module implementing the FFmpeg scale filter used to resize video frames. An integer overflow occurs while computing values derived from attacker-controlled dimensions or stride parameters parsed from a crafted video file. Once the overflow occurs, subsequent arithmetic produces incorrect buffer sizes or offsets, leading the filter into an inconsistent state that terminates the process. Because FFmpeg is invoked automatically by many server-side transcoding and thumbnail-generation workflows, a single crafted file can repeatedly crash worker processes and disrupt media pipelines. The FFmpeg project tracks the report in FFmpeg Issue #21587.

Root Cause

The root cause is an unchecked arithmetic operation on integer values derived from container or codec metadata. The scale filter uses these values to size internal buffers and iterate over pixel rows. Without proper bounds validation before multiplication or addition, values that exceed the representable range wrap around. The resulting undersized allocation or invalid loop bound then causes the process to abort or dereference invalid memory.

Attack Vector

An attacker crafts a video file with header fields or stream parameters that trigger the overflow when passed through the scale filter. Delivery paths include user uploads to media platforms, email attachments processed by preview services, and shared links opened in media players that use FFmpeg. Exploitation requires user interaction, such as opening the file or submitting it to a service that automatically invokes FFmpeg. The attacker gains no code execution or data disclosure; the impact is confined to process termination and service disruption.

No verified proof-of-concept code is publicly available. Refer to the upstream FFmpeg Issue #21587 for reproduction details.

Detection Methods for CVE-2026-38343

Indicators of Compromise

Repeated abnormal termination of ffmpeg or applications linking libavfilter, especially with SIGABRT or SIGSEGV signals during scale operations
Crash dumps or core files referencing vf_scale.c or the sws_scale code path
Spikes in failed transcoding jobs or thumbnail generation tasks tied to specific uploaded files

Detection Strategies

Enable and centralize FFmpeg stderr logs to capture assertion failures and abort messages from the scale filter
Correlate media-processing worker restarts with the hash of the input file being processed at the time of failure
Deploy file-type validation and format sanity checks at ingestion to flag videos with anomalous dimension metadata

Monitoring Recommendations

Alert on elevated crash rates or restart loops in transcoding services, media preview generators, and video CDN workers
Track process exit codes for FFmpeg-based containers and pods in orchestrated environments
Retain samples of files that trigger worker crashes for offline analysis and signature development

How to Mitigate CVE-2026-38343

Immediate Actions Required

Inventory all systems and applications that bundle or link FFmpeg, including third-party media libraries and container images
Isolate media-processing workers behind resource limits and automatic restart policies to contain DoS impact
Reject or quarantine untrusted video files that fail pre-processing validation before they reach the scale filter

Patch Information

At the time of publication, monitor the upstream tracker at FFmpeg Issue #21587 for the fix commit and updated release. Rebuild dependent applications and container images against a patched FFmpeg once available, and redeploy across all transcoding, streaming, and media-preview services.

Workarounds

Avoid invoking the scale filter on unvalidated user-supplied video files until patched builds are deployed
Enforce strict input validation on video dimensions and metadata at the application layer before passing files to FFmpeg
Run FFmpeg in a sandboxed process with CPU, memory, and time limits to bound the impact of a crash

bash

# Example: run FFmpeg with resource limits and a timeout to contain DoS impact
timeout 30s \
  systemd-run --scope -p MemoryMax=512M -p CPUQuota=50% \
  ffmpeg -i untrusted_input.mp4 -vf scale=1280:720 output.mp4