CVE-2026-38350: FFmpeg Integer Overflow DoS Vulnerability

CVE-2026-38350 Overview

CVE-2026-38350 is an integer overflow vulnerability in the target_sws_fuzzer() function located in libswscale/output.c of FFmpeg build N-122528-gdd2976b9e1. Attackers can trigger the flaw by supplying a crafted input to the affected component. Successful exploitation results in a Denial of Service (DoS) condition against applications that process untrusted media through the vulnerable libswscale routine. The weakness is classified under CWE-190: Integer Overflow or Wraparound. Because FFmpeg libraries are embedded in a broad range of media processing pipelines, transcoding services, and desktop applications, the vulnerability affects any downstream product that links against the impacted build.

Critical Impact
Remote attackers can crash FFmpeg-based services without authentication or user interaction by delivering a crafted media input that triggers the integer overflow in target_sws_fuzzer().

Affected Products

FFmpeg build N-122528-gdd2976b9e1
Applications and services that link the libswscale component from the affected build
Media transcoding and streaming pipelines bundling the vulnerable FFmpeg version

Discovery Timeline

2026-08-28 - CVE-2026-38350 published to the National Vulnerability Database (NVD)
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-38350

Vulnerability Analysis

The vulnerability resides in the target_sws_fuzzer() function within libswscale/output.c. The function performs arithmetic on attacker-influenced size or dimension values without validating that the result stays within the bounds of its integer type. When the computed value wraps around, subsequent memory operations use an incorrect size, which drives the process into an abnormal state and terminates it. FFmpeg's libswscale component handles image scaling and pixel format conversion, so any consumer that passes user-controlled media through the swscale pipeline inherits the exposure. The attack vector is network-reachable when FFmpeg is deployed behind services that accept remote uploads such as media conversion APIs, video streaming ingest, or thumbnail generators.

Root Cause

The root cause is unchecked integer arithmetic on values derived from parsed input. FFmpeg computes buffer or stride parameters using operations that can exceed the maximum value representable by the target integer type. Without a preceding bounds check or a safe-arithmetic helper, the wraparound produces a small or negative value that later drives allocation or indexing, leading to the crash. See FFmpeg Ticket #11686 for upstream analysis.

Attack Vector

An attacker crafts a media file or stream whose header fields or pixel parameters force the overflowing computation inside target_sws_fuzzer(). The payload is then submitted to any service that decodes or rescales content with the affected libswscale build. No credentials or user interaction are required. The vulnerability does not disclose data or grant code execution, but it reliably terminates the processing worker, denying service to legitimate users. Batch pipelines and long-running daemons that share a process across requests are particularly exposed because a single crafted input can halt further work.

No verified public proof-of-concept code is available at the time of writing. Refer to the FFmpeg upstream ticket for technical reproduction details.

Detection Methods for CVE-2026-38350

Indicators of Compromise

Repeated abnormal termination of FFmpeg worker processes or ffmpeg child processes handling untrusted media
Crash logs referencing libswscale/output.c or the target_sws_fuzzer symbol
Spikes of malformed media uploads from a single source followed by service errors in transcoding queues

Detection Strategies

Monitor exit codes and signals (SIGSEGV, SIGABRT) from FFmpeg processes and correlate with the input filename or request ID
Inspect application logs from services that wrap FFmpeg for stack traces containing swscale symbols
Deploy fuzzing-aware sanitizers in staging environments to identify inputs that trigger the overflow before production exposure

Monitoring Recommendations

Track error rates and restart counts for media processing containers or systemd units running FFmpeg
Alert on unusually large or malformed dimension fields in incoming media metadata
Retain crash dumps from FFmpeg workers for at least 30 days to support post-incident investigation

How to Mitigate CVE-2026-38350

Immediate Actions Required

Inventory all systems and container images that ship FFmpeg build N-122528-gdd2976b9e1 or bundle its libswscale library
Restrict untrusted media ingestion paths until an upstream fix is applied
Isolate FFmpeg workers into short-lived processes so a crash affects only a single job

Patch Information

A fixed FFmpeg release addressing the integer overflow in target_sws_fuzzer() should be tracked through FFmpeg Ticket #11686. Rebuild any statically linked applications against a patched FFmpeg build once available, and update distribution packages that vendor the affected version.

Workarounds

Enforce strict input validation on media dimensions, codec parameters, and container fields before invoking FFmpeg
Run FFmpeg under a supervisor that automatically restarts crashed workers to preserve service availability
Apply resource limits (ulimit, cgroups) and seccomp profiles to contain the blast radius of a triggered crash

bash

# Example: run ffmpeg with restricted resources and automatic restart via systemd
# /etc/systemd/system/ffmpeg-worker.service
[Service]
ExecStart=/usr/local/bin/ffmpeg-worker
Restart=always
RestartSec=2
MemoryMax=1G
CPUQuota=100%
NoNewPrivileges=true
PrivateTmp=true