An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of… (CVE-2026-38346)

The vulnerability is an integer overflow in the yuv2planeX_8_c() function of FFmpeg's libswscale/output.c component. When a specially crafted video file is processed, the integer overflow can cause a crash or other denial of service impact. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability (DoS). No information about affected versions or patches is provided in the data. There are no known exploits in the wild at this time.

Successful exploitation results in a denial of service, causing the affected application or system to crash or become unresponsive. There is no indication of confidentiality or integrity impact. The attack can be performed remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or suspicious video files with the affected FFmpeg version to mitigate risk.