CVE-2026-38350

Awaiting Analysis Awaiting Analysis - Queue

Integer Overflow in FFmpeg Leading to DoS

Publication date: 2026-08-28

Last updated on: 2026-09-09

Assigner: MITRE

Description

An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-38350

EUVD

EUVD-2026-67316

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in the target_sws_fuzzer() function located in libswscale/output.c of FFmpeg. An integer overflow occurs when a calculation exceeds the maximum value an integer can hold, causing unexpected behavior. In this case, it can lead to a Denial of Service (DoS) when a specially crafted input is provided.

Detection Guidance

This vulnerability is specific to FFmpeg's target_sws_fuzzer() function and requires code analysis or fuzzing to detect. No direct network or system detection commands are provided in the available context. Reviewing FFmpeg's source code for the affected function or using fuzzing tools like AFL or libFuzzer may help identify the issue.

Impact Analysis

This vulnerability can impact you by causing your FFmpeg application to crash or become unresponsive when processing malicious input files. This could disrupt media processing tasks, lead to system instability, or require restarting affected services.

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via integer overflow in FFmpeg's target_sws_fuzzer() function. It does not directly impact compliance with GDPR or HIPAA as it is a technical DoS issue rather than a data breach or privacy violation.

Mitigation Strategies

Update FFmpeg to the latest stable version to address the integer overflow in libswscale/output.c. Avoid processing untrusted media files until patched.

Hi! I’m here to help you understand CVE-2026-38350. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70