CVE-2026-38344

FFmpeg build N-122528-gdd2976b9e1 contains a NULL pointer dereference (CWE-476) in the get_min_buffer_size function in libswscale/slice.c. An attacker triggers it by supplying a crafted video file that an FFmpeg-based application processes through the swscale slice-based scaling path, causing the process to crash. The impact is denial of service only (CVSS 3.1: 7.5, C:N/I:N/A:H), with no code execution or data exposure. Anyone running that FFmpeg build, or applications and services bundling its libswscale/FFmpeg libraries, is potentially affected; the available data does not specify which stable release versions carry the flaw. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known, and EPSS puts 30-day exploitation probability at only 0.3%.

What to do: Organizations that process untrusted video with FFmpeg (transcoding services, streaming/media servers, media pipelines) should check their bundled FFmpeg build (e.g., via 'ffmpeg -version') and update to a patched FFmpeg build once the upstream fix and affected release range are published in the FFmpeg advisory for CVE-2026-38344. As interim mitigation, restrict ingestion of video files from untrusted sources and configure processing workers to restart automatically on crash, since the impact is limited to a crash/denial of service. With no known PoC or in-the-wild exploitation and low EPSS, urgency is low, but monitor the upstream advisory for the fixed versions.