CVE-2026-38350 in FFmpeg
Summary
by MITRE • 08/28/2026
An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in the target_sws_fuzzer function within the libswscale/output.c module of FFmpeg represents a critical integer overflow flaw that can be leveraged by an attacker to execute a denial of service attack against systems processing multimedia content. This specific component is responsible for scaling and converting video frames, a process that involves complex arithmetic operations when calculating buffer sizes, memory allocations, or array indices based on input dimensions such as width and height. When the target_sws_fuzzer function processes crafted inputs with extreme or malformed dimension values, it fails to properly validate these parameters before performing mathematical calculations. This lack of validation allows an integer overflow to occur during the computation phase, where the result exceeds the maximum value that can be stored in the designated variable type, typically a signed 32-bit integer.
The technical mechanism behind this flaw relies on the predictable behavior of two's complement arithmetic used by most modern processors. When an addition or multiplication operation results in a number larger than what the data type can hold, it wraps around to a negative value or a small positive number depending on the specific operation and sign bit interpretation. In the context of memory allocation functions like malloc or realloc, which often rely on these calculated sizes, this wrap-around effect leads to an allocation request for a significantly smaller buffer than intended by the application logic. Subsequently, when the program proceeds to write video data into this undersized buffer based on the original large dimensions, it triggers a heap-based buffer overflow. Although the immediate symptom described is a denial of service, typically manifesting as a crash or segmentation fault due to memory corruption, such conditions can sometimes be exploited for more severe outcomes if the attacker has control over the content written beyond the boundary.
From an operational perspective, this vulnerability poses a significant risk to any application that integrates FFmpeg for video processing tasks, including streaming services, media players, and automated video analysis tools. An attacker who can supply maliciously crafted input files or streams containing specific dimension metadata can trigger this overflow remotely if the service processes untrusted content without adequate sanitization. The impact is primarily a denial of service, causing the application to terminate unexpectedly, leading to service disruption for legitimate users. In environments where high availability is critical, such as live broadcasting platforms or cloud-based video processing pipelines, repeated exploitation could lead to substantial downtime and operational costs. Furthermore, while the primary classification is DoS, memory corruption vulnerabilities are often precursors to code execution exploits if additional conditions align, making this a potential security risk beyond mere stability issues.
This vulnerability maps directly to CWE-190, which defines integer overflow or wraparound errors, as well as CWE-787, out-of-bounds write, due to the subsequent memory corruption resulting from incorrect size calculations. In terms of attack vectors and tactics, this aligns with MITRE ATT&CK techniques related to resource exhaustion, specifically T1499 Endpoint Denial of Service or potentially T1059 Command and Scripting Interpreter if the crash leads to unstable states exploitable for further attacks. The flaw highlights the importance of rigorous input validation in multimedia libraries that handle untrusted data from external sources.
To mitigate this risk, developers must implement strict bounds checking on all dimension parameters before they are used in arithmetic operations or memory allocation calls within libswscale. This includes validating that width and height values fall within expected ranges for standard video formats and ensuring that intermediate calculations do not exceed the limits of their data types. Utilizing safe integer libraries or compiler flags such as -ftrapv can help detect these overflows during development and testing phases. Additionally, applying patches from FFmpeg upstream is essential, as newer versions likely include fixes for this specific issue in target_sws_fuzzer. For end-users and administrators, restricting the processing of untrusted video files to isolated environments or sandboxes can reduce the blast radius if an exploit attempt occurs. Regular security audits focusing on multimedia parsing logic are recommended to identify similar vulnerabilities across other components of the FFmpeg suite.