CVE-2026-38349 Overview
CVE-2026-38349 is an integer overflow vulnerability in the hScale16To19_c() function located in libswscale/output.c of FFmpeg. The flaw affects FFmpeg build N-122528-gdd2976b9e1. An attacker can trigger the overflow by supplying a crafted image file to a vulnerable FFmpeg process. Successful exploitation causes a Denial of Service (DoS) condition. The weakness is classified under CWE-190 (Integer Overflow or Wraparound). No authentication or user interaction beyond processing the malicious file is required.
Critical Impact
A remote attacker can crash any application or service that uses FFmpeg's libswscale component to process untrusted image input, disrupting media pipelines and transcoding workflows.
Affected Products
- FFmpeg build N-122528-gdd2976b9e1
- Applications embedding the affected libswscale component
- Media pipelines and transcoding services using vulnerable FFmpeg builds
Discovery Timeline
- 2026-08-28 - CVE-2026-38349 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-38349
Vulnerability Analysis
The defect resides in hScale16To19_c(), a horizontal scaling routine in FFmpeg's software scaler library libswscale. The function performs arithmetic on 16-bit source samples to produce 19-bit intermediate values used during image resampling. When the function processes dimensions and filter coefficients derived from a crafted image, intermediate arithmetic exceeds the range of the underlying integer type. The wraparound produces invalid buffer indices or sizes, which causes the process to terminate or enter an unrecoverable state. The result is a reliable Denial of Service against any consumer of the affected build.
Root Cause
The root cause is missing or insufficient bounds validation on values used inside hScale16To19_c() before arithmetic operations. Attacker-controlled parameters from the image header influence loop counters and pixel width calculations. When these values are large or specifically shaped, the resulting integer overflow bypasses subsequent sanity checks. This is a classic CWE-190 pattern in native media processing code.
Attack Vector
An attacker delivers a crafted image file to a target that decodes or transcodes it with a vulnerable FFmpeg build. Delivery paths include uploads to web services, email attachments, thumbnail generation pipelines, and streaming platforms that call libswscale. No credentials are required, and exploitation can occur across the network wherever untrusted media is processed. See the FFmpeg Issue Discussion for reproducer details.
No verified public exploit code is available. The vulnerability is described in the upstream issue tracker rather than through a released proof of concept.
Detection Methods for CVE-2026-38349
Indicators of Compromise
- Repeated crashes or segmentation faults in processes linking libswscale when handling image input.
- Core dumps referencing hScale16To19_c or nearby symbols in libswscale/output.c.
- Spikes in failed media transcoding jobs correlated with specific inbound files.
Detection Strategies
- Inventory hosts and containers to identify FFmpeg build N-122528-gdd2976b9e1 and dependent applications.
- Enable crash reporting on media services and alert on unexpected termination of FFmpeg worker processes.
- Sandbox and fuzz-test inbound image files before passing them to production transcoding pipelines.
Monitoring Recommendations
- Monitor process exit codes and restart counts for services embedding libswscale.
- Log the origin, hash, and dimensions of all image files submitted to transcoding endpoints.
- Correlate application crash telemetry with recent uploads to identify malicious submitters.
How to Mitigate CVE-2026-38349
Immediate Actions Required
- Identify all systems running FFmpeg build N-122528-gdd2976b9e1 or applications bundling the affected libswscale.
- Restrict acceptance of untrusted image files until the affected component is upgraded or patched.
- Isolate transcoding workloads in sandboxed processes with resource limits and automatic restart policies.
Patch Information
No fixed release version is listed in the NVD entry at the time of publication. Track the upstream FFmpeg Issue Discussion for the corrective commit and rebuild libswscale from a version that includes the fix once available.
Workarounds
- Validate image dimensions and reject files exceeding realistic width, height, or bit-depth thresholds before invoking libswscale.
- Run FFmpeg inside a low-privilege sandbox with seccomp or containerization so crashes do not affect the host.
- Disable code paths that call hScale16To19_c() where operationally feasible, for example by constraining pixel formats accepted by the pipeline.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.