CVE-2026-38348

Awaiting Analysis Awaiting Analysis - Queue

Integer Overflow in FFmpeg Leading to DoS

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: MITRE

Description

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-38348

EUVD

EUVD-2026-67317

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in the libswscale/utils.c component of FFmpeg. It occurs when processing a crafted image file, potentially leading to a Denial of Service (DoS) by causing the application to crash or become unresponsive.

Detection Guidance

This vulnerability involves an integer overflow in FFmpeg's libswscale component. Detection requires checking for vulnerable FFmpeg versions and analyzing image processing operations. Monitor for crashes or hangs during image file processing, especially with large or malformed files. Use FFmpeg's debug logs to trace scaling operations and watch for overflow warnings.

Impact Analysis

If you use FFmpeg to process untrusted image files, an attacker could exploit this flaw to crash the application, disrupting your workflow or services that rely on FFmpeg for media processing.

Compliance Impact

The provided CVE data does not specify any direct impact on compliance with standards like GDPR or HIPAA. The vulnerability only describes a potential Denial of Service (DoS) condition due to an integer overflow in FFmpeg's libswscale component.

Mitigation Strategies

Update FFmpeg to the latest stable version to address the integer overflow issue in libswscale/utils.c. Avoid processing untrusted image files until patched.

Hi! I’m here to help you understand CVE-2026-38348. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70