CVE-2026-107677

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-107677
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e Patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592 Issue Tracking Patch
https://ffmpeg.org/ Product
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726 Product
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238 Product
https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
History

14 Oct 2026, 23:55

Type Values Removed Values Added
CPE cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
First Time Ffmpeg
Ffmpeg ffmpeg
References () https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e - () https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e - Patch
References () https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592 - () https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592 - Issue Tracking, Patch
References () https://ffmpeg.org/ - () https://ffmpeg.org/ - Product
References () https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726 - () https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726 - Product
References () https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238 - () https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238 - Product
References () https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media - () https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media - Third Party Advisory

08 Oct 2026, 16:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-08 16:17

Updated : 2026-10-14 23:55

NVD link : CVE-2026-107677

Mitre link : CVE-2026-107677

CVE.ORG link : CVE-2026-107677

JSON object : View

Products Affected

ffmpeg

  • ffmpeg
CWE
CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')