{"id":"CVE-2026-107677","state":"PUBLISHED","title":"FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media","description":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.","publishedAt":"2026-10-08T15:28:42.682Z","updatedAt":"2026-10-08T16:03:10.865Z","severity":{"score":5.7,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["FFmpeg FFmpeg"],"affected":[{"vendor":"FFmpeg","product":"FFmpeg","packageURL":"pkg:github/ffmpeg/ffmpeg","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"9.0.2","versionType":"semver"}],"repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg"}],"references":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","https://ffmpeg.org/","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media"],"weaknesses":["CWE-835"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/107xxx/CVE-2026-107677.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-107677","state":"PUBLISHED","datePublished":"2026-10-08T15:28:42.682Z","dateUpdated":"2026-10-08T16:03:10.865Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-10-08T15:11:28.211Z"},"containers":{"cna":{"title":"FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media","descriptions":[{"lang":"en","value":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely."}],"affected":[{"vendor":"FFmpeg","product":"FFmpeg","packageURL":"pkg:github/ffmpeg/ffmpeg","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"9.0.2","versionType":"semver"}],"repo":"https://code.ffmpeg.org/FFmpeg/FFmpeg"}],"references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592","tags":["patch"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e","tags":["patch"]},{"url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238","tags":["technical-description"]},{"url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726","tags":["technical-description"]},{"url":"https://ffmpeg.org/","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media","name":"VulnCheck Advisory: FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-835","lang":"en","description":"Loop with Unreachable Exit Condition ('Infinite Loop')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-10-08T15:28:42.682Z"},"datePublic":"2026-09-20T23:56:30.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*","versionEndIncluding":"9.0.2"}]}]}],"credits":[{"lang":"en","value":"Joshua Rogers (AISLE Research)","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-08T16:00:16.353750Z","id":"CVE-2026-107677","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-08T16:03:10.865Z"}}]}}}