CVE-2026-38348

CVE-2026-38348 is an integer overflow (CWE-190) in the libswscale/utils.c component of FFmpeg, identified in development build N-122528-gdd2976b9e1. An attacker triggers the flaw by supplying a crafted image file to software that processes it with the vulnerable libswscale scaling code. Successful exploitation causes a denial of service: the CVSS vector (AV:N/AC:L/PR:N/UI:N, availability-only) indicates a remote, unauthenticated attacker can render the affected service unavailable with high availability impact but no confidentiality or integrity loss. Any deployment running FFmpeg builds containing the vulnerable libswscale code — whether used directly or bundled inside other media applications, media servers, or transcoding pipelines — is potentially affected. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Inventory where FFmpeg or bundled libswscale code is deployed (distribution packages, Docker images, media servers, transcoding pipelines) and update to a patched FFmpeg build as soon as the fix is incorporated into a release you use. Until patched, limit or sandbox processing of untrusted image files — for example, run transcoding workers in resource-capped, isolated environments so a crafted image cannot take down shared services. Watch vendor advisories for the confirmed affected/fixed version ranges, since only a development build identifier is currently documented.