CVE-2026-38346: n/a

An integer overflow exists in the yuv2planeX_8_c() function within the libswscale/output.c file of FFmpeg (commit N-122528-gdd2976b9e1). This vulnerability allows an attacker to cause a denial of service by supplying a specially crafted video file that triggers the overflow during video processing. The CVSS v3.1 score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability (DoS). No known exploits or vendor patches are currently documented.

Successful exploitation results in a denial of service, causing the affected FFmpeg process to crash or become unresponsive. There is no indication of confidentiality or integrity impact. The attack can be performed remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or suspicious video files with vulnerable FFmpeg versions. Monitor official FFmpeg channels for updates or patches addressing this issue.