CVE-2026-38346 in FFmpeg
Summary
by MITRE • 08/28/2026
An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in the yuv2planeX_8_c() function within FFmpeg's libswscale/output.c module represents a critical integer overflow issue that can be exploited by malicious actors to disrupt service availability. This specific component is responsible for handling color space conversions, particularly when processing YUV video formats which are ubiquitous in digital media streams and files. The flaw arises during the arithmetic operations performed on buffer dimensions or pixel counts within this function. When an attacker supplies a crafted video file with manipulated header information or metadata that specifies unusually large width or height values, the internal calculations for memory allocation or loop iterations can exceed the maximum limit of the integer data type used by the system. This overflow condition leads to incorrect memory addressing or buffer size miscalculations, which subsequently triggers an application crash or undefined behavior rather than gracefully handling the error state.
From a technical perspective, this vulnerability is classified under CWE-190 Integer Overflow or Wraparound, as it involves arithmetic operations that produce results too large for the allocated storage type without proper validation checks before execution. The exploitation vector typically involves crafting a video file where specific parameters such as frame dimensions are set to values near the integer boundary limits. When FFmpeg processes this malicious input during decoding or scaling operations, the overflow causes the application to access memory outside of its intended bounds or attempt to allocate an impossibly large buffer size depending on how the subsequent code handles the wrapped value. This often results in a segmentation fault or immediate termination of the process, effectively causing a Denial of Service for any system relying on FFmpeg for media processing tasks such as video streaming servers, content delivery networks, or local playback applications that automatically parse incoming files.
The operational impact of this vulnerability is significant because it allows remote attackers to achieve service disruption without requiring authentication or user interaction beyond the initial file upload or stream ingestion. In environments where FFmpeg is used in a headless capacity for transcoding large volumes of video content, an attacker could repeatedly send crafted requests to exhaust server resources by causing frequent crashes and restarts, thereby degrading performance for legitimate users. Furthermore, if the application does not implement robust error handling around these low-level C functions, the instability can propagate up the stack, potentially affecting dependent services that rely on stable media processing outputs. The lack of input validation regarding dimension constraints prior to arithmetic operations is a common pitfall in multimedia libraries and highlights the necessity for rigorous boundary checking during data ingestion phases.
Mitigation strategies should focus on implementing strict input validation at the earliest possible stage of file parsing, ensuring that all dimensional parameters such as width and height are checked against reasonable maximum thresholds before they are used in any arithmetic calculations within libswscale. Developers must also consider upgrading to patched versions of FFmpeg where this specific integer overflow has been addressed through enhanced bounds checking or safer arithmetic implementations like saturating addition functions that prevent wraparound behavior. Additionally, deploying runtime protection mechanisms such as Address Sanitizers during testing phases can help identify similar latent issues in other parts of the codebase. For end-users and administrators, restricting the types of files accepted by media processing services to trusted sources and implementing rate limiting on upload endpoints can reduce the exposure surface against automated exploitation attempts targeting this class of vulnerabilities aligned with ATT&CK techniques related to resource exhaustion via application layer attacks.