CVE-2026-38345 in FFmpeg
Summary
by MITRE • 08/28/2026
A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in the specified version of FFmpeg, specifically within the ff_sws_init_single_context function located in libswscale/utils.c, represents a critical arithmetic error that can lead to service disruption. This flaw is categorized under CWE-369, which denotes divide by zero errors. In software engineering, such an error occurs when a program attempts to perform division where the divisor evaluates to zero at runtime without proper validation or exception handling mechanisms in place. The ff_sws_init_single_context function is responsible for initializing single context structures used during video scaling and color space conversion operations within FFmpeg's libswscale library. This component processes input media streams, applying various transformations before outputting the result. When a crafted input triggers this specific code path with conditions that cause a divisor to become zero, the application fails to handle the arithmetic exception gracefully.
From an operational perspective, the immediate impact of this vulnerability is a Denial of Service against applications relying on FFmpeg for media processing. Since C and similar low-level languages do not automatically catch division by zero exceptions in all contexts, the result is typically a segmentation fault or core dump that terminates the process abruptly. For services such as video streaming platforms, surveillance systems, or any application performing real-time transcoding, this abrupt termination can lead to significant downtime. Attackers who possess access to upload media files or control input streams for processing can exploit this flaw by constructing malicious inputs designed to trigger the specific code path leading to the division operation with a zero divisor. This does not typically allow for remote code execution but severely impacts availability and reliability, which are core pillars of the CIA triad in information security.
The technical root cause lies in insufficient validation of input parameters before they are used in arithmetic calculations within the scaling context initialization logic. The function likely calculates dimensions or strides based on user-supplied metadata from video containers such as MP4, MKV, or AVI files. If an attacker manipulates these headers to specify invalid width, height, or pixel format configurations that result in a zero value for a variable used as a divisor during context setup, the crash is triggered. This highlights a common pattern in multimedia processing libraries where complex mathematical operations are performed on untrusted data without rigorous boundary checks. The vulnerability affects FFmpeg N-122528-gdd2976b9e1 and potentially subsequent versions if not patched, emphasizing the need for continuous code review of media parsing routines.
Mitigation strategies should focus primarily on updating to a version of FFmpeg where this issue has been resolved by developers who added proper checks before performing division operations. Organizations utilizing FFmpeg in their infrastructure must ensure that their dependency management systems are configured to pull secure updates promptly. Additionally, implementing defense-in-depth measures such as running media processing services within sandboxed environments or containers can limit the blast radius of a successful exploitation attempt. Input validation at the application layer should also be strengthened to reject malformed metadata before it reaches the core FFmpeg libraries. Monitoring for abnormal process terminations and segmentation faults in logs related to video processing tasks can aid in early detection of potential exploitation attempts, allowing security teams to respond quickly to emerging threats targeting multimedia infrastructure.