CVE-2026-38346

Awaiting Analysis Awaiting Analysis - Queue

Integer Overflow in FFmpeg Causes Denial of Service

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: MITRE

Description

An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-38346

EUVD

EUVD-2026-67319

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in the yuv2planeX_8_c() function within the libswscale/output.c file of FFmpeg. It allows attackers to cause a Denial of Service by providing a specially crafted video file that triggers the overflow.

Detection Guidance

This vulnerability is triggered by a crafted video file exploiting an integer overflow in FFmpeg's yuv2planeX_8_c() function. Detection requires analyzing video files or FFmpeg processing for crashes or memory corruption when handling YUV video data. Monitor FFmpeg logs for segmentation faults or abnormal termination during video processing. Use tools like Valgrind to detect memory issues during FFmpeg execution.

Impact Analysis

The impact is primarily a Denial of Service, meaning an attacker could crash or freeze the affected system by exploiting this flaw through a malicious video file.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Denial of Service (DoS) issue in FFmpeg's video processing. Compliance risks would arise only if the DoS disrupts systems handling regulated data.

Mitigation Strategies

Update FFmpeg to the latest stable version to patch the integer overflow in yuv2planeX_8_c(). Avoid processing untrusted video files until patched.

Hi! I’m here to help you understand CVE-2026-38346. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70