Every CVESearch/Get API key

CVE-2026-38345

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c)...

6.5 MediumFix available

CVE-2026-38345 is a medium vulnerability (CVSS 6.5) in ffmpeg, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. Fixed in ffmpeg 7:8.1-1.

Severity
6.5 MediumCVSS 3.1, CVE List
Exploit chance
0.36%EPSS, 29th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
7:8.1-1ffmpeg +25 more

Description

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.36%Up 0.2 points since Aug 28, 2026
90%50%10%1%

Affected packages

Affected packages
PackageAffectedFixed
ffmpeg
Debian:14
before 7:8.1-1, plus listed versions
7:7.1.1-17:7.1.2-17:7.1.3-17:8.0-17:8.0-27:8.0.1-17:8.0.1-27:8.0.1-3
7:8.1-1
ffmpeg
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
ffmpeg
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
ffmpeg
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
ffmpeg
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
ffmpeg
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
ffmpeg
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
ffmpeg
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
ffmpeg
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
ffmpeg
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
ffmpeg
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
ffmpeg
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
ffmpeg
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
ffmpeg
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 25 CVEs
before 3.4.2-150200.11.88.1
3.4.2-150200.11.88.1
libav
Ubuntu:Pro:14.04:LTS
All versions, plus listed versions
6:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu6
Show 9 moreShow less
6:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.16:9.16-0ubuntu0.14.04.16:9.18-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.1+esm1
None known
ffmpeg
Ubuntu:Pro:16.04:LTS
All versions, plus listed versions
7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1
Show 31 moreShow less
7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm27:2.8.17-0ubuntu0.1+esm37:2.8.17-0ubuntu0.1+esm47:2.8.17-0ubuntu0.1+esm57:2.8.17-0ubuntu0.1+esm67:2.8.17-0ubuntu0.1+esm77:2.8.17-0ubuntu0.1+esm87:2.8.17-0ubuntu0.1+esm97:2.8.17-0ubuntu0.1+esm107:2.8.17-0ubuntu0.1+esm117:2.8.17-0ubuntu0.1+esm127:2.8.17-0ubuntu0.1+esm137:2.8.17-0ubuntu0.1+esm147:2.8.17-0ubuntu0.1+esm157:2.8.17-0ubuntu0.1+esm167:2.8.17-0ubuntu0.1+esm177:2.8.17-0ubuntu0.1+esm18
None known
ffmpeg
Ubuntu:Pro:18.04:LTS
All versions, plus listed versions
7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1
Show 25 moreShow less
7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.17:3.4.8-0ubuntu0.27:3.4.11-0ubuntu0.17:3.4.11-0ubuntu0.1+esm17:3.4.11-0ubuntu0.1+esm27:3.4.11-0ubuntu0.1+esm37:3.4.11-0ubuntu0.1+esm47:3.4.11-0ubuntu0.1+esm57:3.4.11-0ubuntu0.1+esm67:3.4.11-0ubuntu0.1+esm77:3.4.11-0ubuntu0.1+esm87:3.4.11-0ubuntu0.1+esm97:3.4.11-0ubuntu0.1+esm107:3.4.11-0ubuntu0.1+esm117:3.4.11-0ubuntu0.1+esm127:3.4.11-0ubuntu0.1+esm137:3.4.11-0ubuntu0.1+esm147:3.4.11-0ubuntu0.1+esm157:3.4.11-0ubuntu0.1+esm16
None known
ffmpeg
Ubuntu:Pro:20.04:LTS
All versions, plus listed versions
7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu1
Show 21 moreShow less
7:4.2.4-1ubuntu0.17:4.2.4-1ubuntu0.1+esm17:4.2.7-0ubuntu0.17:4.2.7-0ubuntu0.1+esm17:4.2.7-0ubuntu0.1+esm27:4.2.7-0ubuntu0.1+esm37:4.2.7-0ubuntu0.1+esm47:4.2.7-0ubuntu0.1+esm57:4.2.7-0ubuntu0.1+esm67:4.2.7-0ubuntu0.1+esm77:4.2.7-0ubuntu0.1+esm87:4.2.7-0ubuntu0.1+esm97:4.2.7-0ubuntu0.1+esm107:4.2.7-0ubuntu0.1+esm117:4.2.7-0ubuntu0.1+esm127:4.2.7-0ubuntu0.1+esm137:4.2.7-0ubuntu0.1+esm147:4.2.7-0ubuntu0.1+esm157:4.2.7-0ubuntu0.1+esm167:4.2.7-0ubuntu0.1+esm177:4.2.7-0ubuntu0.1+esm18
None known
ffmpeg
Ubuntu:Pro:22.04:LTS
All versions, plus listed versions
7:4.4-6ubuntu57:4.4.1-2ubuntu17:4.4.1-3ubuntu17:4.4.1-3ubuntu27:4.4.1-3ubuntu3
Show 19 moreShow less
7:4.4.1-3ubuntu57:4.4.2-0ubuntu0.22.04.17:4.4.2-0ubuntu0.22.04.1+esm17:4.4.2-0ubuntu0.22.04.1+esm27:4.4.2-0ubuntu0.22.04.1+esm37:4.4.2-0ubuntu0.22.04.1+esm47:4.4.2-0ubuntu0.22.04.1+esm57:4.4.2-0ubuntu0.22.04.1+esm67:4.4.2-0ubuntu0.22.04.1+esm77:4.4.2-0ubuntu0.22.04.1+esm87:4.4.2-0ubuntu0.22.04.1+esm97:4.4.2-0ubuntu0.22.04.1+esm107:4.4.2-0ubuntu0.22.04.1+esm117:4.4.2-0ubuntu0.22.04.1+esm127:4.4.2-0ubuntu0.22.04.1+esm137:4.4.2-0ubuntu0.22.04.1+esm147:4.4.2-0ubuntu0.22.04.1+esm157:4.4.2-0ubuntu0.22.04.1+esm167:4.4.2-0ubuntu0.22.04.1+esm17
None known
ffmpeg
Ubuntu:Pro:24.04:LTS
All versions, plus listed versions
7:6.0-6ubuntu17:6.0-9ubuntu17:6.1-2ubuntu17:6.1-3ubuntu17:6.1-4ubuntu1
Show 17 moreShow less
7:6.1-5ubuntu17:6.1.1-1ubuntu17:6.1.1-3ubuntu17:6.1.1-3ubuntu57:6.1.1-3ubuntu5+esm17:6.1.1-3ubuntu5+esm27:6.1.1-3ubuntu5+esm37:6.1.1-3ubuntu5+esm47:6.1.1-3ubuntu5+esm57:6.1.1-3ubuntu5+esm67:6.1.1-3ubuntu5+esm77:6.1.1-3ubuntu5+esm87:6.1.1-3ubuntu5+esm107:6.1.1-3ubuntu5+esm117:6.1.1-3ubuntu5+esm127:6.1.1-3ubuntu5+esm137:6.1.1-3ubuntu5+esm15
None known
ffmpeg
Ubuntu:26.10
All versions, plus listed versions
7:8.0.1-3ubuntu27:8.1-3ubuntu37:8.1.2-2ubuntu2
None known
ffmpeg
Ubuntu:Pro:26.04:LTS
All versions, plus listed versions
7:7.1.1-1ubuntu47:7.1.2-1ubuntu37:7.1.2-1ubuntu47:7.1.3-1ubuntu17:8.0.1-2ubuntu1
Show 6 moreShow less
7:8.0.1-3ubuntu17:8.0.1-3ubuntu27:8.0.1-3ubuntu2+esm17:8.0.1-3ubuntu2+esm37:8.0.1-3ubuntu2+esm47:8.0.1-3ubuntu2+esm5
None known
ffmpeg-8
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
before 8.1.2-5.1
8.1.2-5.1
ffmpeg-4
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
before 4.4.8-6.1
4.4.8-6.1
ffmpeg-7
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
before 7.1.5-4.1
7.1.5-4.1
ffmpeg-9
openSUSE:Tumbleweed
From an advisory covering 15 CVEs
before 9.0.2-5.1
9.0.2-5.1

What each source reports

CVE List Score used6.5

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
CVE-2026-38345
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-369
Updated
2026-11-02
EUVDEUVD-2026-673186.5

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
EUVD-2026-67318
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-rgh2-m3vh-23hp6.5

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c)...

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
GHSA-rgh2-m3vh-23hp
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-369
Updated
2026-11-02
NVD6.5

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
CVE-2026-38345
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-369
Updated
2026-11-02
OSVDEBIAN-CVE-2026-383456.5

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
DEBIAN-CVE-2026-38345
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-383456.5

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Record
UBUNTU-CVE-2026-38345
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVopenSUSE-SU-2026:11794-1No score

ffmpeg-8-8.1.2-5.1 on GA media

These are all security issues fixed in the ffmpeg-8-8.1.2-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11794-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12064-1No score

ffmpeg-4-4.4.8-6.1 on GA media

These are all security issues fixed in the ffmpeg-4-4.4.8-6.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12064-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12108-1No score

ffmpeg-7-7.1.5-4.1 on GA media

These are all security issues fixed in the ffmpeg-7-7.1.5-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12108-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12417-1No score

ffmpeg-9-libavcodec-devel-9.0.2-5.1 on GA media

These are all security issues fixed in the ffmpeg-9-libavcodec-devel-9.0.2-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12417-1
Updated
2026-11-05
OSVSUSE-SU-2026:5220-1No score

Security update for ffmpeg

This update for ffmpeg fixes the following issues:

  • CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).
  • CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).
  • CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer (bsc#1234029).
  • CVE-2026-18393: Heap buffer overflow in tdsc_load_cursor() via CUR_FMT_MONO cursor (bsc#1277377).
  • CVE-2026-38344: A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file (bsc#1277309).
  • CVE-2026-38345: FFmpeg: Denial of Service via division-by-zero vulnerability in ff_sws_init_single_context function (bsc#1277376).
  • CVE-2026-38346: FFmpeg: Denial of Service via crafted video file due to integer overflow (bsc#1277375).
  • CVE-2026-38347: FFmpeg: Heap overflow vulnerability leads to Denial of Service (bsc#1277373).
  • CVE-2026-38348: FFmpeg: Denial of Service via crafted image file due to integer overflow (bsc#1277368).
  • CVE-2026-38349: FFmpeg: Denial of Service via crafted image file due to integer overflow (bsc#1277369).
  • CVE-2026-38350: FFmpeg: Integer overflow leads to Denial of Service (bsc#1277370).
  • CVE-2026-52296: out-of-bounds read due to missing required padding in WMA extradata allocation paths (bsc#1280752).
  • CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).
  • CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).
  • CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows (bsc#1274268).
  • CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap memory reads (bsc#1274270).
  • CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized heap memory reads (bsc#1274282).
  • CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap memory reads (bsc#1274287).
  • CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds writes (bsc#1274289).
  • CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).
  • CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).
  • CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).
  • CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).
  • CVE-2026-90815: out-of-bounds read in the convolution video filter when processing videos with dimensions smaller than the convolution kernel size (bsc#1280754).
  • CVE-2026-90816: CPU exhaustion due to missing validations in the parse_playlist() function when processing a crafted HLS playlist (bsc#1280755).
Record
SUSE-SU-2026:5220-1
Updated
2026-11-13

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 56 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open