Executive brief
FFmpeg is widely used for video processing and encoding across many applications. A flaw in its video scaling filter allows an attacker to cause the application to crash by supplying a maliciously crafted video file with excessively large scaling parameters, disrupting availability of video processing services.
Technical details
The vulnerability is a signed integer overflow in libavfilter/vf_scale.c (lines 653 and 661) that occurs during calculation of output image dimensions when scaling video. An attacker can provide a crafted video file and invoke the scale filter with an extremely large width parameter (e.g., 536870944 pixels), causing the width × height multiplication to overflow a 32-bit signed integer. This triggers undefined behavior detected by UndefinedBehaviorSanitizer, resulting in a Denial of Service via process termination. The attack requires the ability to supply input to FFmpeg's scale filter (e.g., through a video file), but no authentication is needed and the overflow is triggered during normal filter processing.
Affected products
- FFmpeg FFmpeg N-122528-gdd2976b9e1 and likely other versions
Timeline
- 2026-01-26: disclosed: Bug reported in FFmpeg issue tracker #21587
- 2026-08-28: advisory: CVE-2026-38343 published