CVE-2026-38349 in FFmpeg
Summary
by MITRE • 08/28/2026
An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in the hScale16To19_c function within the libswscale component of FFmpeg represents a critical integer overflow issue that can be exploited to disrupt service availability. This specific code path is responsible for handling horizontal scaling operations, particularly when converting pixel data between different color depths or formats during video and image processing tasks. The flaw arises from improper validation of input dimensions or buffer sizes before performing arithmetic calculations related to memory allocation or array indexing. When an attacker supplies a crafted image file with maliciously constructed header information or metadata specifying extreme width or height values, the internal calculation logic fails to account for integer boundary limits. This results in an overflow condition where the computed size wraps around to a significantly smaller positive value than intended by the system architecture.
From a technical perspective, this flaw aligns closely with CWE-190, which classifies integer overflows that occur during arithmetic operations and lead to subsequent memory corruption or logic errors. In the context of FFmpeg's libswscale, the overflow typically manifests when determining the size of temporary buffers required for scaling algorithms. Because the calculated buffer size is erroneously small due to the wrap-around effect, subsequent memory allocation routines may allocate insufficient space. When the application proceeds to write pixel data into this undersized buffer based on the original, larger dimensions implied by the image file, a heap-based buffer overflow occurs. This overwrites adjacent memory structures, potentially corrupting critical control data such as function pointers or object headers within the heap metadata.
The operational impact of exploiting this vulnerability is primarily focused on causing a Denial of Service against applications that utilize FFmpeg for media processing. By triggering the integer overflow and subsequent out-of-bounds write, an attacker can cause the application to crash immediately due to segmentation faults triggered by memory protection mechanisms like ASLR or DEP. In more sophisticated scenarios where heap metadata corruption is achieved without immediate crashing, it could potentially lead to arbitrary code execution, although the primary reported impact remains service disruption. This affects a wide range of downstream applications including web servers processing uploaded media files, video streaming platforms transcoding content in real-time, and desktop multimedia players that automatically parse incoming file headers.
Mitigation strategies for this vulnerability involve both immediate patching and long-term architectural improvements. The most effective remediation is to apply the specific update associated with FFmpeg commit dd2976b9e1 or any subsequent version where the hScale16To19_c function has been patched to include rigorous bounds checking before arithmetic operations. Developers integrating FFmpeg into their products should ensure they are using a supported and updated release branch rather than older stable versions that may lack these fixes. Furthermore, implementing input validation at the application layer to reject images with excessively large dimensions or malformed headers can provide an additional defense-in-depth measure. Security teams should also monitor for exploitation attempts by analyzing logs for unusual spikes in memory usage or process crashes associated with media processing services.
This vulnerability is categorized under ATT&CK technique T1496, which covers Resource Hijacking through denial of service attacks that consume system resources to degrade performance or availability. While the primary vector here is a local file-based exploit rather than network-driven remote code execution, the mechanism relies on manipulating resource allocation logic via crafted input files. Organizations relying on FFmpeg for critical infrastructure should prioritize updating their media processing libraries and conduct audits of any custom implementations of image scaling routines to ensure similar integer overflow protections are in place across all components handling untrusted visual data inputs.