Integer Overflow in FFmpeg Causes Denial of Service Vulnerability
CVE-2026-38346

7.5HIGH

Key Information:

Vendor

FFmpeg

Status
FFmpeg
Vendor
CVE Published:
27 August 2026

What is CVE-2026-38346?

An integer overflow vulnerability exists in the yuv2planeX_8_c() function of FFmpeg, allowing attackers to create specially crafted video files that can lead to Denial of Service attacks. By exploiting this flaw, malicious actors can disrupt normal operations of the FFmpeg application, potentially causing significant service interruptions. It is essential for users of affected versions to implement security best practices and update to patched versions to mitigate this risk.

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.