CVE-2026-38346

An integer overflow in the yuv2planeX_8_c() function within libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 allows a remote attacker to cause a Denial of Service by supplying a specially crafted video file, leading to the application becoming unresponsive or crashing. The CVSS 3.1 score is 7.5...

CVE-2026-38344

CVE-2026-38344 is a NULL pointer dereference in the get_min_buffer_size function within /libswscale/slice.c of FFmpeg N-122528-gdd2976b9e1 . By supplying a crafted video file , an attacker can trigger a crash resulting in Denial of Service . The CNA-assigned CVSS 3.1 score is 7.5 (High) with a ve...

Division by zero

Overview Affected versions of this package are vulnerable to Division by zero via the ffswsinitsinglecontext function. An attacker can cause the application to become unresponsive or crash by providing specially crafted input. Remediation Upgrade ffmpeg to version 8.1 or higher. References -...

PT-2026-82759

A Division-by-Zero vulnerability in the ff sws init single context function /libswscale/utils.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2026-82758

A NULL pointer dereference in the get min buffer size function /libswscale/slice.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...

CVE-2026-38347

A heap overflow in the ffswsalphablendaway function libswscale/alphablend.c of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-38343

An integer overflow in the libavfilter/vfscale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...

PT-2026-82764

An integer overflow in the target sws fuzzer function libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted input...

PT-2026-82762

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted image file...

CVE-2026-38348

An integer overflow in the libswscale/utils.c component of FFmpeg (version N-122528-gdd2976b9e1) allows a remote attacker with no privileges or user interaction to cause a Denial of Service by supplying a crafted image file, potentially rendering the application unresponsive or crashing. The vuln...

CVE-2026-38349

CVE-2026-38349 is an integer overflow in the hScale16To19_c() function within libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 . A remote attacker can trigger a Denial of Service (DoS) by supplying a crafted image file, causing the application to crash or become unresponsive. The flaw is scored...

CVE-2026-38344

A NULL pointer dereference in the getminbuffersize function /libswscale/slice.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...

CVE-2026-38347

A heap overflow in the ffswsalphablendaway function libswscale/alphablend.c of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-38348

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted image file...

CVE-2026-38349

An integer overflow in the hScale16To19c function libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted image file...

CVE-2026-38350

An integer overflow in the targetswsfuzzer function libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted input...

Important: Red Hat Security Advisory: RHEL AI 3.3 RPM runtime CVE fix - ffmpeg

AIPCC Security Alerts identified CVEs in the 3.3 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file

A flaw was found in FFmpeg. A remote attacker could exploit a signed integer overflow vulnerability in the MACE6 audio decoder by providing a specially crafted CAF Core Audio Format file. This malicious file manipulates the bytesperpacket value, leading to an undersized memory allocation and a he...

ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter

A flaw was found in FFmpeg. A remote attacker can exploit a heap out-of-bounds write vulnerability within the vfhqdn3d filter by providing a specially crafted video file. When filtergraph reinitialization is disabled, the filter allocates undersized memory buffers for video frames. Subsequent...

FFmpeg: Denial of Service via crafted RTP/ASF stream

A flaw was found in FFmpeg. A remote attacker can exploit an infinite loop vulnerability in the RTP/ASF demuxer by sending a specially crafted stream. This vulnerability occurs because the rtpasffixheader function does not properly validate the size of data chunks, preventing the processing loop...