FFmpeg CVE-2026-38347

Triggering the vulnerability requires that the target application: (1) uses FFmpeg git-master at or near commit 722a217, (2) invokes the libswscale alpha blending code path - meaning it processes media input that contains an alpha channel component, and (3) accepts or fetches that media from an attacker-controlled source without prior validation. Applications processing only fully opaque media (e.g., standard H.264/H.265 streams without transparency) may never reach ff_sws_alphablendaway and are therefore not exploitable through this path. From the CVSS vector (PR:N/UI:N), no authentication and no user interaction are required when FFmpeg operates as a server-side automatic media processor; exploitation is bounded by whether the alpha blending code path is reachable in a given deployment.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a worst-case scenario where a server-side application automatically decodes untrusted media submitted by unauthenticated users - common in media transcoding services, video ingestion pipelines, and streaming platforms. In that deployment context the score is appropriate. However, real-world risk is bounded by whether alpha blending is invoked in the processing path: applications handling only opaque media formats may never reach the vulnerable code. EPSS at 0.15% (5th percentile) is very low and indicates negligible current exploitation probability, consistent with no public exploit code and no CISA KEV listing. The impact is strictly limited to availability - no confidentiality or integrity compromise is possible through this path, making this a denial-of-service issue rather than a code-execution risk. Overall priority is moderate: the CVSS ceiling is elevated but the narrow impact class and low exploitation interest support treating this as a routine patch item rather than an emergency.

An attacker submits a specially crafted video or image file with manipulated alpha channel data to a web-facing media transcoding or processing service built on FFmpeg. When libswscale routes the file through ff_sws_alphablendaway, the heap overflow corrupts adjacent allocations, crashing the FFmpeg worker process or host application. No public exploit code is identified at time of analysis, so exploitation requires the attacker to independently develop a suitable malicious input.