CVE-2026-38346: FFmpeg Integer Overflow DoS Vulnerability

CVE-2026-38346 Overview

CVE-2026-38346 is an integer overflow vulnerability in the yuv2planeX_8_c() function located in libswscale/output.c of FFmpeg build N-122528-gdd2976b9e1. An attacker can trigger a denial-of-service condition by supplying a crafted video file that FFmpeg processes through its scaling library. The flaw is classified under CWE-190: Integer Overflow or Wraparound. Exploitation requires no authentication and no user interaction beyond providing the malicious input to a vulnerable FFmpeg instance. The vulnerability affects availability but does not impact confidentiality or integrity.

Critical Impact
A crafted video file processed by FFmpeg triggers an integer overflow in libswscale, crashing the process and denying service to any application that depends on FFmpeg for video transcoding, streaming, or thumbnail generation.

Affected Products

FFmpeg N-122528-gdd2976b9e1
Applications and services embedding vulnerable libswscale builds
Media pipelines relying on FFmpeg for YUV plane scaling

Discovery Timeline

2026-08-28 - CVE-2026-38346 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-38346

Vulnerability Analysis

The defect resides in yuv2planeX_8_c(), a C routine in FFmpeg's software scaling library libswscale. This function combines multiple filtered YUV source planes into a single 8-bit output plane during pixel format conversion and scaling. The function performs weighted sum arithmetic across filter coefficients and source samples before writing packed 8-bit values to the destination buffer.

An attacker crafts a video file whose dimensions, filter parameters, or pixel values force intermediate arithmetic to exceed the bounds of the signed integer type used inside the accumulator. The overflow produces undefined values that propagate into downstream memory operations, causing FFmpeg to abort. Applications that call FFmpeg synchronously lose service until the process restarts.

Root Cause

The root cause is missing validation of arithmetic bounds on values used by yuv2planeX_8_c() before they participate in scaled multiplication and addition. When accumulated products exceed the representable range of the integer type, the result wraps and violates the function's internal invariants. FFmpeg then reaches an inconsistent state that terminates execution.

Attack Vector

An unauthenticated remote attacker delivers a malformed media file to any service that decodes or transcodes video through the vulnerable FFmpeg build. Common delivery paths include web upload endpoints, streaming ingestion pipelines, chat attachment previews, and automated thumbnail workers. See the FFmpeg Issue #21584 tracker for the technical proof.

No exploit code is required beyond the crafted file itself. The vulnerability affects only availability; it does not yield code execution or data disclosure.

Detection Methods for CVE-2026-38346

Indicators of Compromise

Repeated FFmpeg process crashes or SIGABRT signals during media decoding or scaling operations
Unexpected termination of transcoding workers immediately after ingesting user-supplied video files
Media pipeline logs referencing libswscale/output.c or yuv2planeX_8_c in stack traces
Sudden queue backlog in upload processing services following delivery of unusual video content

Detection Strategies

Monitor FFmpeg exit codes and correlate abnormal termination with the specific input file that was being processed
Inspect video ingest logs for repeated failures tied to a single uploader, tenant, or source IP
Enable core dump collection on media workers and alert on crashes referencing libswscale symbols
Track FFmpeg version strings across the fleet and flag hosts still running the vulnerable N-122528 build

Monitoring Recommendations

Instrument media transcoding services with process supervision that captures crash rates per input source
Forward FFmpeg stderr and syslog output to a central log store for pattern analysis
Alert on statistically abnormal spikes in transcoding failures, which frequently indicate active abuse

How to Mitigate CVE-2026-38346

Immediate Actions Required

Inventory every host, container image, and application bundling FFmpeg and identify builds derived from N-122528-gdd2976b9e1
Isolate media transcoding workloads behind resource limits and automatic restart policies to contain denial-of-service impact
Restrict media upload endpoints with authentication, rate limiting, and file-type validation until patched builds are deployed
Sandbox FFmpeg execution using process isolation so that a crash does not degrade adjacent services

Patch Information

Refer to the upstream FFmpeg Issue #21584 for the maintainers' remediation status and rebuild against a fixed FFmpeg revision once available. Rebuild any statically linked applications and refresh container base images that vendor FFmpeg binaries.

Workarounds

Disable server-side transcoding for untrusted content until a fixed FFmpeg build is deployed
Pre-validate uploaded media dimensions and codec parameters before invoking libswscale
Run FFmpeg workers under a supervisor that restarts the process on abnormal termination to preserve availability
Route untrusted media through a hardened sandbox with strict CPU, memory, and time budgets

bash

# Configuration example
# Verify installed FFmpeg build and rebuild containers on a patched revision
ffmpeg -version | head -n 1
docker image ls --format '{{.Repository}}:{{.Tag}}' | xargs -I{} docker run --rm {} ffmpeg -version 2>/dev/null | head -n 1