Executive brief
FFmpeg is a widely-used multimedia framework that processes video and audio files. An integer overflow vulnerability in its image scaling library (libswscale) can be triggered when processing specially-crafted video files with extreme dimensions, causing the application to crash and denying service to users who rely on FFmpeg for media conversion or streaming.
Technical details
An integer overflow vulnerability exists in libswscale/utils.c:214 when FFmpeg processes video frames with very large heights (e.g., 16×65535 pixels) during scaling operations with certain pixel format conversions (e.g., yuva444p10be). The vulnerable code performs arithmetic on a 32-bit signed integer that exceeds the type's range (-2147483648 - 65536), triggering undefined behavior detected by sanitizers. The attack vector is local/network-adjacent via supplying a crafted video file; no authentication is required. An attacker can trigger a denial of service (application crash) by providing a malicious media file. A patch is expected to validate input dimensions or use larger integer types to prevent overflow.
Affected products
- FFmpeg FFmpeg N-122528-gdd2976b9e1 and likely other recent versions
Timeline
- 2026-01-26: disclosed: Bug report filed on FFmpeg Forgejo tracker
- 2026-08-28: advisory: CVE-2026-38348 published by NVD