CVE-2026-38349

CVE-2026-38349 is an integer overflow (CWE-190) in the hScale16To19_c() function of FFmpeg's libswscale image-scaling library (libswscale/output.c), identified in the development build N-122528-gdd2976b9e1. It is triggered when the library processes a specially crafted image file whose pixel or dimension values push the 16-to-19-bit horizontal scaling routine beyond its representable numeric range. An attacker who can make an application or service decode such an image gains a denial of service (crash or hang) with no confidentiality or integrity impact, consistent with the CVSS 3.1 score of 7.5 (network vector, high availability impact only). Anyone embedding or running the affected FFmpeg code and decoding untrusted images — e.g., media servers, thumbnail generators, upload validators, and transcoding pipelines — is potentially affected, though the available data identifies only the N-122528-gdd2976b9e1 git-master snapshot and does not specify which released versions carry the flaw. Exploitation is not currently observed: there is no public proof of concept, no CISA KEV listing, and EPSS is low at roughly 0.3% (25th percentile) for the next 30 days.

What to do: Track the upstream FFmpeg fix and rebuild or upgrade to a build newer than commit N-122528-gdd2976b9e1 (or apply the upstream patch) as soon as patched packages are available, and check which FFmpeg revision your distributions, containers, and bundled/embedded copies actually ship. In the meantime, harden media-processing services: sandbox or isolate image-decode workers, cap resource limits so crashes cannot take down the whole service, and restrict processing of untrusted image files from unauthenticated sources.