FFmpeg: Eight DoS Vulnerabilities in libswscale Disclosed Together
Eight Denial of Service vulnerabilities were disclosed in FFmpeg on August 28, 2026, primarily impacting the libswscale component and allowing attackers to crash the software with crafted media files.
Key findings
- Eight Denial of Service vulnerabilities disclosed together in FFmpeg on August 28, 2026.
- All vulnerabilities affect the libswscale component, primarily through integer overflows and heap overflows.
- Exploitation could lead to disruption of services relying on FFmpeg for media processing.
- FFmpeg has released patches; users should update to the latest version.
On August 28, 2026, a batch of eight Denial of Service (DoS) vulnerabilities were disclosed together in the FFmpeg multimedia framework. These vulnerabilities, all discovered by the same researcher and disclosed on the same day, primarily affect the libswscale component, which is responsible for image scaling and conversion. The widespread nature of these flaws across various functions within libswscale could allow attackers to disrupt services by crashing FFmpeg instances through specially crafted media files.
The disclosed vulnerabilities include several instances of integer overflows, a heap overflow, a division-by-zero error, and a NULL pointer dereference.
Specifically, CVE-2026-38350, CVE-2026-38349, and CVE-2026-38346 all stem from integer overflows within the target_sws_fuzzer() and hScale16To19_c() functions in libswscale/output.c, and yuv2planeX_8_c() in libswscale/output.c respectively. These flaws can be triggered by crafted inputs, leading to a DoS. CVE-2026-38348, another integer overflow, resides in libswscale/utils.c.
Further exacerbating the risk, CVE-2026-38347 involves a heap overflow in the ff_sws_alphablendaway function located in libswscale/alphablend.c. This vulnerability can also be exploited via crafted inputs to cause a denial of service. Additionally, CVE-2026-38345 presents a division-by-zero vulnerability in ff_sws_init_single_context within libswscale/utils.c, again allowing for DoS attacks through crafted inputs.
The batch also includes a NULL pointer dereference in get_min_buffer_size in libswscale/slice.c, identified as CVE-2026-38344, which can be triggered by crafted video files. Finally, CVE-2026-38343, an integer overflow in libavfilter/vf_scale.c, rounds out the set of vulnerabilities, also exploitable via crafted video files.
All eight vulnerabilities were disclosed on August 28, 2026, and appear to have been fixed in a single release or commit, as indicated by the consistent reference to "N-122528-gdd2976b9e1" or "git-master commit 722a217" across the descriptions. Users of FFmpeg are strongly advised to update to the latest version to mitigate the risk of these DoS vulnerabilities. The consistent disclosure of multiple DoS flaws in a core component like libswscale highlights the importance of timely patching and security auditing for multimedia processing software.
Given the nature of these vulnerabilities, which primarily lead to Denial of Service, the immediate impact is the potential for attackers to disrupt services relying on FFmpeg for media processing. While no specific exploitation in the wild or threat actor attribution has been mentioned in the provided details, the ease with which these DoS conditions can be triggered via crafted inputs means that any unpatched FFmpeg instances are at risk.
The FFmpeg project has addressed these issues, and users should ensure they are running the most recent version of the software. The consistent reporting of these bugs by a single source and their simultaneous disclosure suggest a focused security audit or fuzzing effort that uncovered a cluster of related weaknesses within the libswscale library. This batch serves as a reminder of the complex and interconnected nature of multimedia processing code and the potential for seemingly minor flaws to aggregate into a significant security concern.
Moving forward, developers and system administrators should remain vigilant for further security advisories related to FFmpeg and ensure that their systems are updated promptly to incorporate security patches. The proactive disclosure and patching of these vulnerabilities by the FFmpeg team are crucial steps in maintaining the integrity and availability of services that depend on this widely used multimedia framework.
The common theme across these vulnerabilities is their impact on the libswscale component of FFmpeg, with most leading to Denial of Service conditions. The specific bug classes include integer overflows, heap overflows, division-by-zero errors, and NULL pointer dereferences. All reported vulnerabilities were disclosed on the same day, indicating a coordinated disclosure event.
The FFmpeg project has made fixes available for these issues. Users are urged to update to the latest stable version of FFmpeg to ensure their systems are protected against these vulnerabilities. The specific commit details suggest that these fixes are integrated into recent development builds.
The primary impact of these vulnerabilities is the potential for Denial of Service attacks, which could disrupt services relying on FFmpeg for media processing. While no active exploitation has been reported, the nature of the flaws means that specially crafted inputs could crash FFmpeg instances.
This batch of vulnerabilities underscores the importance of keeping FFmpeg updated, especially for applications that process untrusted media files. The concentration of issues within libswscale highlights this component as a critical area for security attention.
The FFmpeg team has addressed these vulnerabilities, and users should update to the latest version. The fixes are available in recent development commits.
The vulnerabilities were all disclosed on August 28, 2026.
The primary impact is Denial of Service.
All vulnerabilities affect the libswscale component of FFmpeg.
Users should update to the latest version of FFmpeg.