CVE-2026-38346

CVE-2026-38346 is an integer overflow (CWE-190) in the yuv2planeX_8_c() function in libswscale/output.c of FFmpeg, identified in the git master build N-122528-gdd2976b9e1. It is triggered when FFmpeg processes a crafted video file that exercises the affected scaling/pixel-format output path, causing the arithmetic overflow. An attacker who can supply such a file to an application or service that decodes or transcodes video with the vulnerable FFmpeg code can crash the process, resulting in a denial of service; per the CVSS vector there is no confidentiality or integrity impact, only high availability impact. Any deployment that processes untrusted video with an affected FFmpeg build — including media players, transcoding pipelines, and server-side media services where no user interaction is required — is potentially affected. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Monitor FFmpeg upstream (git commits and release notes) for the patch addressing CVE-2026-38346 and rebuild or upgrade to an FFmpeg build that includes the fix once available, since no fixed version number is specified in the current data. In the meantime, reduce exposure by isolating or sandboxing automated transcoding/media-processing workers, restricting which untrusted video files reach FFmpeg-based scaling, and setting resource limits or automatic restarts so a crash cannot take down a whole service.