Executive brief
FFmpeg is a multimedia framework used to encode, decode, and process video and audio files. An integer overflow vulnerability in the video scaling component allows attackers to crash the application by supplying a specially crafted video file with alpha channel scaling, resulting in service unavailability for any application using FFmpeg.
Technical details
A signed integer overflow occurs in the hScale16To19_c() function within libswscale/output.c:1292 when processing video scaling with alpha channels using filters such as Lanczos. Negative filter coefficients produce large negative intermediate values that are not properly bounded by the FFMIN() clamping function, which only constrains the upper bound. These unchecked negative values are subsequently multiplied by 2048 in yuv2rgba64_1_c_template(), causing a signed integer overflow. The vulnerability is triggered via crafted YUVA422P10BE (10-bit video with alpha) input files with specific scaling parameters and can be reliably reproduced without authentication or special network access.
Affected products
- FFmpeg FFmpeg N-122528-gdd2976b9e1 and likely earlier versions
Timeline
- 2026-01-26: disclosed: Bug reported at FFmpeg Forgejo issue #21592
- 2026-08-28: advisory: CVE-2026-38349 published