CVE-2026-38345: n/a

This vulnerability exists in the ff_sws_init_single_context function within the libswscale/utils.c file of FFmpeg (commit N-122528-gdd2976b9e1). An attacker can supply crafted input that causes a division by zero, resulting in a denial of service. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low complexity, no privileges required, user interaction needed, and impact limited to availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation causes a denial of service by crashing the FFmpeg process. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider avoiding processing untrusted inputs with affected FFmpeg versions or using alternative media processing tools.