Description
An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.
Published: 2026-08-27
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Update FFmpeg
AI Analysis

Impact

An integer overflow in libswscale/utils.c allows an attacker to trigger a DoS by supplying a crafted image file. The overflow can corrupt memory or cause the application to crash when decoding the image, preventing normal operation of FFmpeg-based services.

Affected Systems

The flaw exists in FFmpeg, the widely used multimedia framework. Any installation that has not applied the patch that fixes the overflow is potentially vulnerable, regardless of the specific release version listed in this entry.

Risk and Exploitability

The CVSS score is 7.5. The vulnerability is limited to availability impact and is not listed in the CISA KEV catalog. The EPSS score is <1%, indicating a very low probability of exploitation. No public exploit is known; an attacker would need to supply a crafted image through an input channel that uses libswscale, such as a media upload or streaming endpoint.

Generated by OpenCVE AI on August 28, 2026 at 22:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest FFmpeg release that includes the integer overflow fix
  • Restrict or quarantine the use of libswscale when processing untrusted image data
  • Implement input validation or sandboxing for media decoding to prevent crash attempts

Generated by OpenCVE AI on August 28, 2026 at 22:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Fri, 28 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title Integer Overflow in FFmpeg libswscale Causes DoS via Crafted Images ffmpeg: FFmpeg: Denial of Service via crafted image file due to integer overflow
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 28 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Ffmpeg
Ffmpeg ffmpeg
Vendors & Products Ffmpeg
Ffmpeg ffmpeg

Fri, 28 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Integer Overflow in FFmpeg libswscale Causes DoS via Crafted Images
Weaknesses CWE-190

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.
References

Subscriptions

Ffmpeg Ffmpeg
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-28T18:31:55.427Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-38348

cve-icon Vulnrichment

Updated: 2026-08-28T18:31:47.710Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-28T00:17:27.530

Modified: 2026-09-09T15:53:46.577

Link: CVE-2026-38348

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-27T00:00:00Z

Links: CVE-2026-38348 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T22:45:05Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound