FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.
CVE-2026-107677
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-107677
FFmpeg
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
"vendor": "FFmpeg",
"product": "FFmpeg",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "9.0.2"
}
],
"packageURL": "pkg:github/ffmpeg/ffmpeg",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-107677
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #13019 · Revision 1
- Added to Heist Feed
- Publisher date