[NEW] [medium] ffmpeg: Multiple vulnerabilities enable denial of service
A remote, anonymous attacker can exploit multiple vulnerabilities in ffmpeg to conduct a denial of service attack.
CSIRTS triage
- What
- Multiple vulnerabilities in FFmpeg enable remote denial of service attacks.
- Who is affected
- Any deployment of FFmpeg processing untrusted media input.
- Urgency
- Medium severity; not currently exploited but DoS impact warrants timely patching.
- Action
- Update FFmpeg to patched version when available; restrict untrusted input processing as interim measure.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch FFmpeg
Get an email when a new FFmpeg advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3064
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-38343 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-38344 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-38345 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-38346 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-38347 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-38348 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-38349 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-38350 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highCVE-2026-38350: An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-1225…nvd
- highCVE-2026-38349: An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-…nvd
- highCVE-2026-38348: An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows …nvd
- highCVE-2026-38347: A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-…nvd
- highCVE-2026-38346: An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-…nvd
- mediumCVE-2026-38345: A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils…nvd
- highCVE-2026-38344: A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg…nvd
- mediumCVE-2026-38343: An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 all…nvd
Recent advisories for ffmpeg
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] ffmpeg: Multiple vulnerabilitiescert-bund · 2026-09-04
- medium[NEW] [medium] ffmpeg: Multiple vulnerabilities allow code execution and DoScert-bund · 2026-09-04
- high[NEW] [high] ffmpeg: Multiple vulnerabilitiescert-bund · 2026-09-04
- unknownUSN-8716-1: FFmpeg vulnerabilitiesubuntu · 2026-09-03
- medium[NEW] [medium] ffmpeg: Vulnerability enables Denial of Servicecert-bund · 2026-09-02
- unknownCVE-2026-52295: Buffer Overflow vulnerability in Ffmpeg v.7.0 and after allows an attacker to cause a denial o…nvd · 2026-09-01
More from CERT-Bund (BSI) Security Advisories
- medium[NEW] [medium] Langflow: Multiple vulnerabilities2026-09-04
- medium[NEW] [medium] Grafana Enterprise: Multiple vulnerabilities allow gaining user or administrator privileges2026-09-04
- low[NEW] [low] Checkmk: Vulnerability allows Denial of Service2026-09-04
- low[NEW] [low] ImageMagick: Multiple vulnerabilities allow Denial of Service2026-09-04
- critical[NEW] [critical] vm2: Multiple vulnerabilities allow code execution2026-09-04