Executive brief
FFmpeg's libswscale library, which handles video pixel format conversion and scaling, contains an integer overflow vulnerability in its output processing code. An attacker supplying a specially crafted video file could trigger a denial-of-service condition, causing the application to crash or become unresponsive.
Technical details
The vulnerability is a signed integer overflow in libswscale/output.c at lines 1325-1326 within color conversion calculations. The root cause involves arithmetic operations on signed integers that exceed representable range when processing certain pixel format conversions (e.g., yuva420p10le to bgra64le). Attack vector is local via crafted input file to a fuzzing tool or media application; no authentication or network access required. An attacker can trigger undefined behavior leading to DoS; the overflow itself does not appear to enable code execution. A patch has been developed and is available via FFmpeg pull request #20060.
Affected products
- FFmpeg FFmpeg N-122528-gdd2976b9e1 and prior versions
Timeline
- 2025-06: other: Ticket #11686 opened on FFmpeg Trac
- 2026-08-28: disclosed: CVE-2026-38350 published on NVD
- patched: Fix available via FFmpeg pull request #20060