FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.
References
| Link | Resource |
|---|---|
| https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593 | Issue Tracking Patch |
| https://ffmpeg.org/ | Product |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070 | Product |
| https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231 | Product |
| https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes | Third Party Advisory |
Configurations
History
14 Oct 2026, 23:55
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ffmpeg
Ffmpeg ffmpeg |
|
| References | () https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593 - Issue Tracking, Patch | |
| References | () https://ffmpeg.org/ - Product | |
| References | () https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070 - Product | |
| References | () https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231 - Product | |
| References | () https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-stack-exhaustion-via-recursive-free-of-pssh-boxes - Third Party Advisory | |
| CPE | cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* |
08 Oct 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-08 16:17
Updated : 2026-10-14 23:55
NVD link : CVE-2026-107678
Mitre link : CVE-2026-107678
CVE.ORG link : CVE-2026-107678
JSON object : View
Products Affected
ffmpeg
- ffmpeg
CWE
CWE-674
Uncontrolled Recursion