Executive brief
FFmpeg, a widely used multimedia framework for processing audio and video, is vulnerable to a flaw that can cause applications to stop responding. By sending a specially crafted media stream, a remote attacker can trigger an infinite loop that consumes all available processor power. This results in a denial of service, potentially crashing media servers or applications that rely on FFmpeg to process network-based video content.
Technical details
An infinite loop vulnerability exists in the RTP/ASF demuxer within `libavformat/rtpdec_asf.c`. The `rtp_asf_fix_header` function fails to validate a minimum `chunksize` when iterating over ASF objects. If an attacker provides a `chunksize` smaller than the 24-byte minimum ASF object header size, the loop pointer fails to advance, leading to an infinite loop and CPU exhaustion. This can be triggered remotely without authentication by sending a malformed RTP/ASF stream. The issue has been addressed in the FFmpeg master branch by rejecting ASF objects smaller than their header.
Affected products
- FFmpeg FFmpeg 0.6.3 through 8.1.2
Timeline
- 2026-06-30: other: Vulnerability found by Pavel Kohout
- 2026-07-02: patched: Fix merged into FFmpeg master branch
- 2026-07-22: disclosed: CVE published and NVD record created