CVE-2026-38349

HighCVSS 7.5

Published: 28/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

Risk Assessment

An attacker can cause a crash of the application or service using FFmpeg, leading to service unavailability.

Recommendation

Update FFmpeg to the latest version that includes fixes for this type of vulnerability, and avoid processing untrusted image files.

Original NVD description (English source)

An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.