CVE-2026-38344: FFmpeg NULL Pointer Dereference DoS Vulnerability

CVE-2026-38344 Overview

CVE-2026-38344 is a NULL pointer dereference vulnerability in the get_min_buffer_size function located in /libswscale/slice.c of FFmpeg build N-122528-gdd2976b9e1. An attacker can trigger the flaw by supplying a crafted video file to a vulnerable FFmpeg-based application. Successful exploitation causes the process to crash, producing a denial-of-service (DoS) condition. The weakness is classified under [CWE-476: NULL Pointer Dereference]. No authentication or user interaction is required when the affected library processes attacker-controlled media over the network.

Critical Impact
Remote attackers can crash FFmpeg-based media processing services by delivering a malformed video file, disrupting streaming, transcoding, and analysis pipelines.

Affected Products

FFmpeg build N-122528-gdd2976b9e1
Applications and services embedding the affected libswscale component
Media processing pipelines using vulnerable FFmpeg builds for transcoding or scaling

Discovery Timeline

2026-08-28 - CVE-2026-38344 published to the National Vulnerability Database
2026-08-31 - Last updated in the NVD database

Technical Details for CVE-2026-38344

Vulnerability Analysis

The vulnerability resides in the get_min_buffer_size function within FFmpeg's software scaling library, libswscale. When the function processes a crafted video file, it dereferences a pointer that was not properly validated for a NULL value. The dereference forces the FFmpeg process to terminate abnormally.

The flaw is triggered during scaling context setup or slice buffer computation. Because libswscale is invoked by nearly every FFmpeg transcoding workflow, the crash propagates to any application that hands untrusted media to the affected build. The current EPSS probability for this CVE is 0.324%.

Root Cause

The root cause is missing NULL-pointer validation on a structure or buffer descriptor consumed by get_min_buffer_size in /libswscale/slice.c. When the crafted input causes upstream allocation or parameter negotiation to return a NULL reference, the function proceeds to read from it. This produces a segmentation fault characteristic of [CWE-476].

Attack Vector

Exploitation is network-reachable when FFmpeg is used in server-side transcoding, media ingestion APIs, or streaming platforms that accept user-supplied files. An unauthenticated attacker uploads or streams a crafted video that reaches libswscale. The scaler dereferences the NULL pointer, aborting the worker process and denying service to legitimate users. Impact is limited to availability; there is no confidentiality or integrity impact.

Technical details are tracked upstream in FFmpeg Issue #21583.

Detection Methods for CVE-2026-38344

Indicators of Compromise

Repeated segmentation faults or SIGSEGV crash signatures in FFmpeg worker processes handling user-supplied media
Core dumps or stack traces referencing get_min_buffer_size or libswscale/slice.c
Sudden spikes in failed transcoding jobs correlated with specific uploaded video files

Detection Strategies

Monitor process supervisors and orchestration platforms for abnormal FFmpeg exit codes on media ingestion workers
Inspect application logs for repeated crashes tied to a single source IP or uploaded asset ID
Correlate media upload telemetry with backend crash events to identify malformed input campaigns

Monitoring Recommendations

Instrument FFmpeg wrappers to capture and forward crash traces to a centralized logging platform
Alert on threshold breaches for FFmpeg restart counts within short time windows
Track the FFmpeg build string in inventory to identify hosts running N-122528-gdd2976b9e1 or earlier vulnerable snapshots

How to Mitigate CVE-2026-38344

Immediate Actions Required

Identify all systems running FFmpeg build N-122528-gdd2976b9e1 or applications bundling the affected libswscale
Restrict untrusted media uploads to sandboxed workers isolated from production services
Enforce process-level resource limits and automatic restart policies so crashes do not degrade the wider service

Patch Information

Refer to upstream tracking at FFmpeg Issue #21583 for the current fix status. Rebuild FFmpeg from a revision that includes the patched get_min_buffer_size in /libswscale/slice.c and redeploy any dependent container images and packages once the upstream commit is available.

Workarounds

Validate media container and codec parameters before invoking libswscale to reject malformed inputs early
Run FFmpeg workers under strict seccomp or container isolation so crashes are contained and auto-restarted
Rate-limit anonymous media uploads to reduce the impact of repeated crash-inducing submissions

bash

# Confirm the installed FFmpeg build to determine exposure
ffmpeg -version | head -n 1

# Example: run FFmpeg inside an isolated, auto-restarting container
docker run --rm --read-only --cap-drop=ALL \
  --memory=512m --pids-limit=128 \
  --restart=on-failure:5 \
  -v /media/input:/in:ro -v /media/output:/out \
  ffmpeg-patched:latest -i /in/asset.mp4 /out/asset.mp4