CVE-2026-38347 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 37.84%

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	vulnerable
bookworm (security)	vulnerable
forky	7:9.0.2-1 fixed
sid	7:9.0.2-3 fixed
trixie	7:7.1.5-0+deb13u1 fixed
trixie (security)	7:7.1.5-0+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

libav

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Vulnerability Media Exposure

[GERMAN] ffmpeg: Mehrere Schwachstellen ermöglichen Denial of Service
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ffmpeg ausnutzen, um einen Denial of Service Angriff durchzuführen.
Published: 2026-08-27T22:00:00+00:00

References

https://trac.ffmpeg.org/ticket/11692