CVE-2026-107677

Publié : 8 octobre 2026

Modifié : 8 octobre 2026

Score CVSS

4.7

MEDIUM

Description détaillée

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

Références et Patchs

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592 https://ffmpeg.org/https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726 https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238 https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media

Dernières Vulnérabilités

CVE-2026-88647

A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.

VOIR DÉTAILS

CVE-2026-62167

Rejected reason: This CVE is a duplicate of another CVE.

VOIR DÉTAILS

CVE-2026-62166

Rejected reason: This CVE is a duplicate of another CVE.

VOIR DÉTAILS