CVE-2026-38348: FFmpeg libswscale Integer Overflow DoS

CVE-2026-38348 Overview

CVE-2026-38348 is an integer overflow vulnerability in the libswscale/utils.c component of FFmpeg build N-122528-gdd2976b9e1. Attackers can trigger a Denial of Service (DoS) by supplying a crafted image file to an application that uses the affected library. The flaw is classified under CWE-190: Integer Overflow or Wraparound. Because FFmpeg is embedded in many media processing pipelines, the vulnerability can be reached remotely wherever untrusted image input is decoded.

Critical Impact
Remote attackers can crash FFmpeg-based services by submitting a specially crafted image, disrupting availability of media processing workflows.

Affected Products

FFmpeg build N-122528-gdd2976b9e1
Applications and services that link against the vulnerable libswscale library
Media processing pipelines that accept untrusted image input

Discovery Timeline

2026-08-28 - CVE-2026-38348 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-38348

Vulnerability Analysis

The vulnerability resides in libswscale/utils.c, the utility module of FFmpeg's software scaling library. libswscale handles image scaling, colorspace conversion, and pixel format transformations. An integer overflow in this component corrupts internal size or offset calculations when processing a crafted image. The resulting arithmetic wraparound leads to abnormal termination of the process, producing a Denial of Service condition. The vulnerability affects availability only; confidentiality and integrity are not impacted according to the CVSS vector.

Root Cause

The root cause is an unchecked arithmetic operation on attacker-controlled image dimensions or buffer sizes within libswscale/utils.c. When the operands exceed the representable range of the integer type, the result wraps around. Subsequent logic uses the wrapped value as a size, index, or allocation parameter, producing an invalid memory operation or fatal assertion. This is a classic CWE-190 pattern common in media codecs that trust header-supplied dimensions.

Attack Vector

Exploitation requires only that a vulnerable FFmpeg build process a crafted image. No authentication or user interaction is required beyond delivering the file. Common delivery paths include upload endpoints, transcoding services, thumbnail generators, and streaming ingest pipelines. See the FFmpeg Issue Tracker Entry for the reported reproduction details.

No verified public exploit code is available. The vulnerability mechanism is described in prose because no realCodeExamples were provided.

Detection Methods for CVE-2026-38348

Indicators of Compromise

Repeated crashes or segmentation faults in ffmpeg, ffprobe, or downstream services linking libswscale.
Core dumps referencing libswscale/utils.c or sws_ prefixed symbols in stack traces.
Sudden spikes in failed transcoding jobs originating from a small set of client IPs or accounts.

Detection Strategies

Monitor process exit codes and restart counters for FFmpeg worker processes to identify anomalous termination patterns.
Inspect uploaded image files for anomalous width, height, or stride header values that exceed practical limits.
Enable audit logging on media processing services and correlate crashes with the specific input file that triggered the failure.

Monitoring Recommendations

Forward FFmpeg worker logs and crash telemetry to a centralized analytics platform for pattern analysis.
Alert on burst rates of decode failures per source identity to surface DoS attempts early.
Track version fingerprints of deployed FFmpeg binaries across the fleet to identify unpatched instances.

How to Mitigate CVE-2026-38348

Immediate Actions Required

Inventory all systems running FFmpeg build N-122528-gdd2976b9e1 or that statically or dynamically link the affected libswscale.
Restrict untrusted image input at the perimeter until a patched FFmpeg build is deployed.
Isolate media processing workers in sandboxes or containers with automatic restart to limit DoS blast radius.

Patch Information

At the time of publication, no fixed release version is enumerated in the NVD entry. Track the FFmpeg Issue Tracker Entry for the upstream fix commit and rebuild downstream applications once a corrected libswscale/utils.c is available.

Workarounds

Validate image dimensions and file size limits at the application layer before invoking FFmpeg.
Run FFmpeg decoding under strict resource limits using ulimit, systemd sandboxing, or container quotas so crashes do not exhaust host resources.
Reject or quarantine image formats that are not required by the workload to reduce the attack surface exposed to libswscale.

bash

# Configuration example: constrain FFmpeg workers with systemd
# /etc/systemd/system/ffmpeg-worker.service.d/limits.conf
[Service]
MemoryMax=512M
CPUQuota=50%
Restart=on-failure
RestartSec=2s
NoNewPrivileges=true
PrivateTmp=true