{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-38343", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-08-27T20:56:18.700Z", "dateReserved": "2026-04-06T00:00:00.000Z", "datePublished": "2026-08-27T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-27T20:56:18.700Z"}, "descriptions": [{"lang": "en", "value": "An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}}, "dataVersion": "5.2"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}], "id": "CVE-2026-38343", "lastModified": "2026-08-28T00:17:26.980", "metrics": {}, "published": "2026-08-28T00:17:26.980", "references": [{"source": "cve@mitre.org", "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Received"}

{"acknowledgement": "Upstream acknowledges ff0x7c00 as the original reporter.", "bugzilla": {"description": "ffmpeg: FFmpeg: Denial of Service via integer overflow in video scaling", "id": "2525320", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525320"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in FFmpeg. An integer overflow in the `libavfilter/vf_scale.c` component allows attackers to cause a Denial of Service (DoS) by supplying a specially crafted video file. This can lead to the application becoming unresponsive or crashing."], "mitigation": {"lang": "en:us", "value": "No mitigation is currently available for this flaw."}, "name": "CVE-2026-38343", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "ffmpeg", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-vllm-gaudi-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-08-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-38343\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-38343\nhttps://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"], "statement": "The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in libavfilter, which is compiled and shipped in all FFmpeg builds across these products. This vulnerability has low practical impact as FFmpeg already rejects the invalid output size with an error; the integer overflow is undefined behavior detected by sanitizers but does not result in memory corruption.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "N-122528-gdd2976b9e1"}}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "ffmpeg", "vendor": "ffmpeg"}], "created": "2026-08-28T06:00:14.702884+00:00", "updated": "2026-08-28T19:30:16.871345+00:00", "vendors": ["ffmpeg", "ffmpeg$PRODUCT$ffmpeg"]}