Executive brief
FFmpeg's video scaling library (libswscale) contains a NULL pointer dereference vulnerability in the get_min_buffer_size function that can be triggered by processing a specially crafted video file with specific scaling parameters. An attacker can exploit this flaw by supplying a malicious video file that causes the application to crash, resulting in a denial of service that disrupts video processing operations.
Technical details
The vulnerability is a NULL pointer dereference (CWE-476) in libswscale/slice.c:233 within the get_min_buffer_size function. The root cause is improper filter context cleanup during cascaded context creation: when ff_free_filters(c2) is called, it frees filter descriptors but fails to nullify the vLumFilterPos and vChrFilterPos pointers. Subsequently, ff_init_filters(c2) immediately invokes get_min_buffer_size(), which dereferences these invalid pointers without null checks. The vulnerability is triggered through a specific attack vector: supplying a video file with dimensions (e.g., 5x681) that is scaled to 1x1 using advanced scaling algorithms (sinc) with gamma correction enabled and chroma subsampling output format (yuv420p). No authentication is required; the attack occurs during legitimate video processing. An attacker can cause denial of service by crashing the FFmpeg process.
Affected products
- FFmpeg FFmpeg N-122528-gdd2976b9e1 and likely other versions
Timeline
- 2026-01-26: disclosed: Bug report filed on FFmpeg Forgejo issue tracker
- 2026-08-28: advisory: CVE-2026-38344 published