CVE-2026-38350

CVE-2026-38350 is an integer overflow (CWE-190) in the target_sws_fuzzer() function of FFmpeg's software scaling library (libswscale, output.c), identified in development snapshot N-122528-gdd2976b9e1. An attacker triggers it by supplying crafted input to code paths that exercise the swscale scaling logic, causing integer arithmetic to overflow. The result is a denial of service — the affected process crashes — with no confidentiality or integrity impact (CVSS 3.1 C:N/I:N/A:H, network vector, no privileges or user interaction required). Affected deployments are those running FFmpeg builds that include the identified commit, such as master-branch snapshots and downstream products tracking FFmpeg development around that revision; the available data does not enumerate which stable release branches are affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days, so no in-the-wild exploitation is currently known.

What to do: Determine whether your FFmpeg build includes the affected commit (check the git revision reported by 'ffmpeg -version' or your package's build metadata) and rebuild or update to a revision later than N-122528-gdd2976b9e1 once the upstream fix is available; do not assume stable releases are affected until your distributor confirms. As interim mitigation, avoid processing untrusted media files with vulnerable builds, or run FFmpeg transcoding in a crash-isolated worker process with automatic restarts. Monitor the FFmpeg project and your distribution for advisories, since exploitation likelihood is currently assessed as low (EPSS 0.3%).