Executive brief
FFmpeg is a widely-used multimedia framework that processes audio and video files. A heap buffer overflow in the alphablend scaling function can be triggered by processing specially crafted video files, causing the application to crash and potentially allowing arbitrary code execution. This impacts any application or service using FFmpeg for video transcoding or processing.
Technical details
A heap-buffer-overflow vulnerability exists in the ff_sws_alphablendaway function within libswscale/alphablend.c. The vulnerability is triggered during image scaling operations when alpha channel blending is performed on crafted input (specifically yuva420p9be to yuv420p conversion). The flaw results from insufficient bounds checking when reading from the alpha plane buffer, allowing a read operation to access memory beyond the allocated heap region. The vulnerability can be triggered via a network or local vector by providing a malformed video file or stream to an FFmpeg-based application. An attacker can cause a denial of service crash; code execution potential exists depending on memory layout and use context. Patches have been applied as the ticket was closed 7 months ago, indicating fixes are available in current FFmpeg releases.
Affected products
- FFmpeg FFmpeg git-master commit 722a217 and affected releases
Timeline
- 2026-08-28: disclosed: CVE-2026-38347 published
- 2025-02: other: FFmpeg ticket #11692 opened (14 months before publication)
- 2025-09: patched: FFmpeg ticket #11692 closed as fixed (7 months before publication)