CVE-2026-38347 Overview
CVE-2026-38347 is a heap overflow vulnerability in the ff_sws_alphablendaway function located in libswscale/alphablend.c of FFmpeg. The flaw affects FFmpeg git-master commit 722a217. Attackers can trigger the overflow by supplying a crafted input file processed by the affected code path. Successful exploitation causes a Denial of Service (DoS) condition in the multimedia framework. The weakness is classified under CWE-122 (Heap-based Buffer Overflow). FFmpeg is embedded across countless media processing pipelines, streaming platforms, and desktop applications, expanding the attack surface for this issue.
Critical Impact
Remote attackers can crash FFmpeg-based processes by supplying crafted media input, disrupting availability of media processing services without requiring authentication or user interaction.
Affected Products
- FFmpeg git-master commit 722a217
- Applications and services embedding the affected libswscale alphablend code path
- Downstream distributions building from the affected commit
Discovery Timeline
- 2026-08-28 - CVE-2026-38347 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-38347
Vulnerability Analysis
The vulnerability resides in ff_sws_alphablendaway, a function within FFmpeg's libswscale scaling and pixel format conversion library. The function performs alpha blending operations on image data during pixel format conversion. When processing a crafted input, the routine writes beyond the bounds of a heap-allocated buffer.
Heap overflows in image scaling code typically arise from mismatches between declared image dimensions, computed stride values, and actual buffer allocations. The libswscale/alphablend.c implementation blends source pixels over a destination surface using width and height parameters derived from the input. When these parameters are attacker-controlled and insufficiently validated, the write loop exceeds the destination allocation.
The overflow produces a Denial of Service outcome by corrupting adjacent heap metadata or triggering process termination. Refer to FFmpeg Ticket #11692 for reproduction details.
Root Cause
The root cause is a heap-based buffer overflow ([CWE-122]) in ff_sws_alphablendaway. Bounds checks on frame dimensions or stride calculations are insufficient before the alpha blending write loop executes against the heap buffer.
Attack Vector
Exploitation requires an attacker to deliver a crafted media file or stream to an application that invokes the affected libswscale code path. No authentication or user interaction is required when FFmpeg processes untrusted input automatically, such as transcoding services, thumbnail generators, or streaming ingest pipelines. Verified proof-of-concept code is not published beyond the FFmpeg ticket reference.
See FFmpeg Ticket #11692 for the technical reproduction case.
Detection Methods for CVE-2026-38347
Indicators of Compromise
- Unexpected crashes or SIGABRT/SIGSEGV termination of FFmpeg worker processes handling untrusted media
- Heap corruption warnings from allocators such as glibcmalloc_consolidate or AddressSanitizer reports referencing ff_sws_alphablendaway
- Media transcoding jobs failing repeatedly on specific input files with matching hashes
Detection Strategies
- Deploy AddressSanitizer or similar heap instrumentation in test environments to catch out-of-bounds writes in libswscale
- Monitor process telemetry for repeated FFmpeg crashes correlated with untrusted media ingest
- Build detections that flag anomalous exit codes from media processing services within short time windows
Monitoring Recommendations
- Collect crash dumps and stderr from FFmpeg-based services and forward to a centralized logging platform for analysis
- Alert on abnormal restart rates for transcoding workers or media pipeline containers
- Track file hashes of inputs that trigger crashes to identify targeted or repeated abuse patterns
How to Mitigate CVE-2026-38347
Immediate Actions Required
- Identify all systems and applications that bundle FFmpeg built from git-master commit 722a217 or nearby revisions
- Restrict FFmpeg processing of untrusted media to sandboxed workers with resource limits and automatic restart policies
- Validate media inputs at ingress and reject malformed files before they reach libswscale
Patch Information
At the time of publication, the CVE record references FFmpeg Ticket #11692 for tracking. Rebuild FFmpeg from an upstream commit that includes the fix once merged, and redistribute updated binaries to downstream applications. Verify vendor-supplied packages for backported patches.
Workarounds
- Run FFmpeg in isolated containers or seccomp-restricted sandboxes to contain crashes and heap corruption
- Disable alpha blending code paths where not required by configuring pixel format pipelines that avoid libswscale alpha operations
- Apply strict input validation on media dimensions and pixel formats before invoking FFmpeg
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
