Division-by-Zero Vulnerability in FFmpeg Package Leading to Denial of Service
Summary
DEBIAN-CVE-2026-38345: A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input. Affects ffmpeg versions < 7:8.1-1. Fixed in 7:8.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FFmpeg is a widely used open-source software suite for handling multimedia data, including audio and video processing. It provides libraries and tools for encoding, decoding, transcoding, muxing, demuxing, streaming, filtering, and playing almost anything that humans and machines have created. The package is crucial for various applications that require media manipulation. However, it is susceptible to a Division-by-Zero vulnerability that can be exploited by attackers.
Vulnerability Detail
The vulnerability identified as CVE-2026-38345 exists in the ff_sws_init_single_context function located in the libswscale/utils.c file of FFmpeg. This flaw allows attackers to craft specific inputs that can trigger a Division-by-Zero error, leading to a Denial of Service (DoS). The ramifications of this vulnerability include potential crashes of applications using FFmpeg, resulting in service interruptions and degraded user experience. It is critical for users and developers to understand the technical aspects of this vulnerability to mitigate risks effectively.
How To Fix
Minimum fixed version
7:8.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ffmpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or crafted input files that may exploit this vulnerability until the package is updated. Additionally, implementing input validation and sanitization in applications that utilize FFmpeg can help mitigate the risk.
Conclusion
The Division-by-Zero vulnerability in the FFmpeg package poses a significant risk of Denial of Service. Users are encouraged to update to the latest patched version and implement workarounds to mitigate potential impacts. Awareness and proactive measures are essential to maintaining the security of applications that rely on FFmpeg.
See every vulnerability recorded for ffmpeg →
FAQ
CVE-2026-38345 is a Division-by-Zero vulnerability in the FFmpeg package that can lead to Denial of Service.
You can use the Vulert platform to check if your application is affected by this vulnerability without requiring access to the code or installation.
Exploitation of this vulnerability can cause applications using FFmpeg to crash, leading to service disruptions.
Yes, a patched version of FFmpeg (7:8.1-1 or later) is available to fix this vulnerability.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for ffmpeg.
