CVE-2026-38345: FFmpeg Division-by-Zero DoS Vulnerability

CVE-2026-38345 Overview

CVE-2026-38345 is a division-by-zero vulnerability in the ff_sws_init_single_context function within /libswscale/utils.c of FFmpeg build N-122528-gdd2976b9e1. Attackers can trigger the flaw by supplying crafted media input to the affected FFmpeg component. Processing the malformed input causes the software scaling library to perform a division by zero, terminating the process. The condition results in a Denial of Service (DoS) against applications and services that rely on FFmpeg for media transcoding or scaling. The weakness is categorized under CWE-369 (Divide By Zero).

Critical Impact
Remote attackers can crash FFmpeg-backed media processing pipelines by delivering a single crafted input file or stream, disrupting availability.

Affected Products

FFmpeg build N-122528-gdd2976b9e1
Applications embedding the libswscale scaling library from the affected FFmpeg build
Media transcoding, streaming, and thumbnail generation services that pass untrusted input to FFmpeg

Discovery Timeline

2026-08-28 - CVE-2026-38345 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-38345

Vulnerability Analysis

The defect resides in ff_sws_init_single_context, an initialization routine in libswscale that prepares a scaling context based on source and destination image parameters. During context setup, the function performs arithmetic that uses attacker-influenced dimensions or scaling factors as divisors. When a crafted input drives one of these divisors to zero, the CPU raises a divide-by-zero exception and the process aborts.

Because libswscale is invoked by virtually every FFmpeg workflow that resizes or converts pixel formats, the attack surface extends beyond the ffmpeg binary. Any downstream consumer, including transcoders, streaming servers, and web upload processors, inherits the crash condition. Successful exploitation impacts availability only; the CVSS vector reports no confidentiality or integrity impact and requires user interaction to open or process the crafted media.

Root Cause

The root cause is missing validation of computed divisor values before arithmetic operations in ff_sws_init_single_context. Input dimensions, aspect ratios, or scaling coefficients derived from container metadata are not bounds-checked to ensure they remain non-zero prior to use as denominators. This maps directly to CWE-369.

Attack Vector

An attacker crafts a media file or stream with header fields designed to produce a zero divisor inside the scaling initialization path. The attacker delivers the file through any channel that ultimately feeds FFmpeg, including web uploads, email attachments, network streams, or shared links. When a victim application invokes FFmpeg on the input, the process terminates immediately. For further technical detail, refer to the upstream tracker at FFmpeg Issue #21585.

No verified public proof-of-concept code is available. See the FFmpeg Issue #21585 tracker for reproduction details published by the reporter.

Detection Methods for CVE-2026-38345

Indicators of Compromise

Unexpected termination of ffmpeg, ffprobe, or embedding processes with signal SIGFPE (floating-point exception) or exit code 136
Repeated crash logs referencing libswscale/utils.c and ff_sws_init_single_context in application error output
Spikes in failed transcoding jobs originating from a single uploader, source IP, or tenant

Detection Strategies

Correlate media pipeline job failures with the source file hash to identify inputs that consistently crash workers
Alert on process exit codes indicating arithmetic exceptions in media-processing service accounts
Inspect container or host telemetry for FFmpeg child processes terminated by SIGFPE shortly after external input arrives

Monitoring Recommendations

Monitor availability metrics and worker restart counts for transcoding, thumbnail, and streaming services
Retain samples of inputs that trigger FFmpeg crashes for offline analysis and blocklisting
Track the FFmpeg version deployed across build images and runtime hosts to identify exposed workloads

How to Mitigate CVE-2026-38345

Immediate Actions Required

Inventory all systems and container images that ship FFmpeg build N-122528-gdd2976b9e1 or embed the affected libswscale
Upgrade to a fixed FFmpeg release once published upstream and rebuild dependent images
Sandbox FFmpeg execution so that a crash of the worker process does not cascade into the parent service
Rate-limit and validate media uploads to reduce the impact of repeated crash attempts

Patch Information

At the time of publication, tracking for the fix is available at FFmpeg Issue #21585. Rebuild from the corrected upstream commit or upgrade to a distribution package that incorporates the fix once released. Verify the deployed version with ffmpeg -version after patching.

Workarounds

Pre-validate media metadata (width, height, sample aspect ratio) and reject files with zero or non-numeric fields before invoking FFmpeg
Run FFmpeg under a supervisor that automatically restarts crashed workers and quarantines the offending input
Restrict accepted container formats and codecs to those required by the application to shrink the attack surface

bash

# Example: reject media whose reported dimensions are zero before transcoding
ffprobe -v error -select_streams v:0 \
  -show_entries stream=width,height,sample_aspect_ratio \
  -of default=noprint_wrappers=1 "$INPUT" \
  | awk -F= '$2==0 || $2=="" {exit 1}' \
  && ffmpeg -i "$INPUT" -vf scale=1280:720 "$OUTPUT"