Skip to content
Threat Feed
Subscribe
low advisory

FFmpeg RTP/ASF Demuxer Infinite Loop Vulnerability (CVE-2026-64834)

FFmpeg versions 0.6.3 through 8.1.2 are vulnerable to a remote denial of service (DoS) via CVE-2026-64834, allowing an attacker to trigger an infinite loop in the `rtp_asf_fix_header` function by sending a crafted RTP/ASF stream, leading to CPU exhaustion and service unavailability.

CVE-2026-64834 identifies a critical infinite loop vulnerability within the FFmpeg library, affecting versions 0.6.3 through 8.1.2. The flaw resides in the libavformat/rtpdec_asf.c component, specifically within the RTP/ASF demuxer's rtp_asf_fix_header function. A remote attacker can exploit this vulnerability by delivering a malformed RTP/ASF stream. The function's failure to validate a minimum chunksize for ASF objects allows the loop pointer to never advance when processing specially crafted input, leading to an uncontrolled infinite loop. This resource exhaustion ultimately results in a denial of service (DoS) for any application or service utilizing the vulnerable FFmpeg library for media processing, making systems unresponsive and unavailable to legitimate users.

Attack Chain

  1. Craft Malicious RTP/ASF Stream: A remote attacker creates a specially crafted RTP/ASF stream containing an ASF object with a chunksize value smaller than the 24-byte minimum required for an ASF object header.
  2. Deliver Stream to FFmpeg Application: The attacker transmits this malicious RTP/ASF stream to an application or service utilizing the vulnerable FFmpeg library (versions 0.6.3 to 8.1.2) for demuxing, typically over a network.
  3. RTP/ASF Demuxer Processes Stream: The FFmpeg library, specifically the libavformat/rtpdec_asf.c component, receives and begins processing the incoming RTP/ASF stream using its demuxer.
  4. rtp_asf_fix_header Function Invoked: The rtp_asf_fix_header function is called to process ASF objects within the stream, including the malformed chunksize.
  5. Chunksize Validation Failure: The rtp_asf_fix_header function attempts to iterate over ASF objects but fails to validate that the provided chunksize meets the 24-byte minimum requirement.
  6. Infinite Loop Triggered: Due to the invalid chunksize, the loop pointer within rtp_asf_fix_header never advances, resulting in an uncontrolled infinite loop.
  7. CPU Exhaustion and Denial of Service: The infinite loop consumes 100% of the CPU resources of the process running FFmpeg, leading to CPU exhaustion and rendering the service or application unresponsive, thereby achieving a denial of service.

Impact

Successful exploitation of CVE-2026-64834 results in a denial of service (DoS) condition on systems running vulnerable FFmpeg versions. The affected FFmpeg process will enter an infinite loop, causing severe CPU exhaustion and rendering the application or service it supports unresponsive. This can impact critical media processing services, streaming platforms, or any application relying on FFmpeg for RTP/ASF demuxing. The primary consequence is the unavailability of services to legitimate users, potentially leading to operational disruption and financial losses depending on the criticality of the affected system.

Recommendation

  • Upgrade FFmpeg to a patched version beyond 8.1.2 to remediate CVE-2026-64834.
  • Monitor systems running FFmpeg for anomalous high CPU utilization, which could indicate a denial-of-service attempt or successful exploitation of CVE-2026-64834.