CVE-2026-38347

CVE-2026-38347 is a heap-based buffer overflow (CWE-122) in the ff_sws_alphablendaway function of FFmpeg's libswscale scaling library (libswscale/alphablend.c), identified in the FFmpeg git-master tree at commit 722a217. It is triggered when FFmpeg processes crafted input that exercises the alpha-blending path in swscale; the CVSS vector indicates the attack is reachable over a network without privileges or user interaction. A successful attack causes a crash, giving the attacker denial of service only, with no confidentiality or integrity impact per the CVSS scoring (C:N/I:N/A:H). Anyone running FFmpeg builds derived from git-master around commit 722a217, or products embedding such builds, is potentially affected; the full range of affected released versions is not established in the available data. There is currently no known exploitation: no public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS estimates the 30-day exploitation probability at roughly 0.3%.

What to do: No fixed version is identified in the available data, so track FFmpeg upstream (git log/release announcements) for the fix addressing commit 722a217 and update builds to the latest master or the next release containing the patch. Check whether deployed media-processing services build FFmpeg from master near commit 722a217 and whether they scale or convert video with alpha channels through swscale. As interim mitigation, avoid feeding untrusted media through alpha-blending swscale conversions, or isolate decoding/scaling in a sandboxed worker so a crash only affects a single process.