An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via… (CVE-2026-38348)

The vulnerability identified as CVE-2026-38348 is an integer overflow in the libswscale/utils.c component of FFmpeg version N-122528-gdd2976b9e1. This integer overflow can be exploited by an attacker who supplies a specially crafted image file, causing a denial of service by crashing the application or otherwise disrupting its normal operation. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability. There is no information about a patch or fixed versions.

Successful exploitation results in denial of service, impacting the availability of the FFmpeg component processing the crafted image file. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or unauthenticated image files with the affected FFmpeg component to reduce risk.