FFmpeg CVE-2026-38350

Exploitation requires that an attacker can supply crafted media input to an FFmpeg process that invokes the libswscale scaling path. For remote exploitation consistent with the CVSS AV:N vector, FFmpeg must be deployed as part of a service that accepts user-supplied media over a network without prior authentication - such as a media transcoding API, video upload pipeline, or streaming ingest system. Desktop or CLI deployments where a user must manually open a crafted file introduce a user-interaction requirement that reduces effective risk and would be better modeled as AV:L/UI:R. The specific snapshot build N-122528-gdd2976b9e1 must be in use; operators pinned to stable named releases are not confirmed as affected by this specific commit. No privilege escalation or authentication bypass is involved - the overflow affects only process stability.

The NVD-assigned CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a plausible worst-case scenario where FFmpeg is deployed as a server-side transcoding service accepting unauthenticated user-supplied media. However, EPSS at 0.15% (4th percentile) signals that the broader security community and threat actors have shown very little operational interest in this flaw, and no CISA KEV listing confirms active in-the-wild exploitation. The impact is strictly limited to availability - no confidentiality or integrity compromise is possible. The principal risk vector is server-side batch transcoding pipelines or streaming ingest systems that process untrusted media without prior input validation; desktop users face materially lower risk because exploitation in that context requires deliberate user action to open a crafted file. CVSS indicates a network attack vector, which is defensible for service deployments but would not apply universally - teams should verify whether their FFmpeg deployment exposes an unauthenticated network surface before treating this as a top priority.

An attacker submits a crafted image or video file encoding malformed or extreme pixel dimensions to a public-facing transcoding API or media upload endpoint backed by a vulnerable FFmpeg snapshot build. The input triggers an integer overflow in the libswscale output.c path during the scaling operation, causing the FFmpeg worker process to crash and rendering the transcoding service unavailable. No public exploit code has been identified at time of analysis.