Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-27T00:00:00 ffmpeg: FFmpeg: Denial of Service via crafted image file due to integer overflow 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-190

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file.

A flaw was found in FFmpeg, specifically within the libswscale/utils.c component. An integer overflow vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted image file. This could lead to the application becoming unresponsive or crashing.

The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in libswscale, which is compiled and shipped in all FFmpeg builds across these products. Upstream acknowledges ff0x7c00 as the original reporter. No mitigation is currently available for this flaw. Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred ffmpeg Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-vllm-gaudi-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-38348 https://nvd.nist.gov/vuln/detail/CVE-2026-38348 https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588