{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/media/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-64834"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg (0.6.3 through 8.1.2)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","ffmpeg","media"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eCVE-2026-64834 identifies a critical infinite loop vulnerability within the FFmpeg library, affecting versions 0.6.3 through 8.1.2. The flaw resides in the \u003ccode\u003elibavformat/rtpdec_asf.c\u003c/code\u003e component, specifically within the RTP/ASF demuxer's \u003ccode\u003ertp_asf_fix_header\u003c/code\u003e function. A remote attacker can exploit this vulnerability by delivering a malformed RTP/ASF stream. The function's failure to validate a minimum chunksize for ASF objects allows the loop pointer to never advance when processing specially crafted input, leading to an uncontrolled infinite loop. This resource exhaustion ultimately results in a denial of service (DoS) for any application or service utilizing the vulnerable FFmpeg library for media processing, making systems unresponsive and unavailable to legitimate users.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eCraft Malicious RTP/ASF Stream\u003c/strong\u003e: A remote attacker creates a specially crafted RTP/ASF stream containing an ASF object with a chunksize value smaller than the 24-byte minimum required for an ASF object header.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeliver Stream to FFmpeg Application\u003c/strong\u003e: The attacker transmits this malicious RTP/ASF stream to an application or service utilizing the vulnerable FFmpeg library (versions 0.6.3 to 8.1.2) for demuxing, typically over a network.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRTP/ASF Demuxer Processes Stream\u003c/strong\u003e: The FFmpeg library, specifically the \u003ccode\u003elibavformat/rtpdec_asf.c\u003c/code\u003e component, receives and begins processing the incoming RTP/ASF stream using its demuxer.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ertp_asf_fix_header\u003c/code\u003e Function Invoked\u003c/strong\u003e: The \u003ccode\u003ertp_asf_fix_header\u003c/code\u003e function is called to process ASF objects within the stream, including the malformed chunksize.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eChunksize Validation Failure\u003c/strong\u003e: The \u003ccode\u003ertp_asf_fix_header\u003c/code\u003e function attempts to iterate over ASF objects but fails to validate that the provided chunksize meets the 24-byte minimum requirement.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInfinite Loop Triggered\u003c/strong\u003e: Due to the invalid chunksize, the loop pointer within \u003ccode\u003ertp_asf_fix_header\u003c/code\u003e never advances, resulting in an uncontrolled infinite loop.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCPU Exhaustion and Denial of Service\u003c/strong\u003e: The infinite loop consumes 100% of the CPU resources of the process running FFmpeg, leading to CPU exhaustion and rendering the service or application unresponsive, thereby achieving a denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-64834 results in a denial of service (DoS) condition on systems running vulnerable FFmpeg versions. The affected FFmpeg process will enter an infinite loop, causing severe CPU exhaustion and rendering the application or service it supports unresponsive. This can impact critical media processing services, streaming platforms, or any application relying on FFmpeg for RTP/ASF demuxing. The primary consequence is the unavailability of services to legitimate users, potentially leading to operational disruption and financial losses depending on the criticality of the affected system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade FFmpeg to a patched version beyond 8.1.2 to remediate CVE-2026-64834.\u003c/li\u003e\n\u003cli\u003eMonitor systems running FFmpeg for anomalous high CPU utilization, which could indicate a denial-of-service attempt or successful exploitation of CVE-2026-64834.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T18:35:25Z","date_published":"2026-07-22T18:35:25Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-dos-cve-2026-64834/","summary":"FFmpeg versions 0.6.3 through 8.1.2 are vulnerable to a remote denial of service (DoS) via CVE-2026-64834, allowing an attacker to trigger an infinite loop in the `rtp_asf_fix_header` function by sending a crafted RTP/ASF stream, leading to CPU exhaustion and service unavailability.","title":"FFmpeg RTP/ASF Demuxer Infinite Loop Vulnerability (CVE-2026-64834)","url":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-dos-cve-2026-64834/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-64830"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg 2.1","FFmpeg 8.1.2"],"_cs_severities":["high"],"_cs_tags":["vulnerability","heap-overflow","ffmpeg","arbitrary-code-execution","media"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eA significant heap buffer overflow vulnerability, identified as CVE-2026-64830, has been discovered in FFmpeg versions ranging from 2.1 through 8.1.2. This flaw resides within the VobSub subtitle demuxer component. The vulnerability can be exploited by an attacker who crafts a specially designed \u003ccode\u003e.sub\u003c/code\u003e or \u003ccode\u003e.idx\u003c/code\u003e subtitle file. This malicious file is configured to declare a number of distinct stream IDs that exceeds the fixed-size array boundaries within \u003ccode\u003elibavformat/mpeg.c\u003c/code\u003e. When an application utilizing FFmpeg's VobSub demuxer attempts to process such a file, the \u003ccode\u003eff_subtitles_queue_insert()\u003c/code\u003e function triggers an unbounded write beyond the \u003ccode\u003evobsub-\u0026gt;q[]\u003c/code\u003e array, leading to heap memory corruption. Successful exploitation could result in arbitrary code execution within the context of the vulnerable application, posing a severe risk to systems processing untrusted media content.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker creates a malicious VobSub subtitle file (either \u003ccode\u003e.sub\u003c/code\u003e or \u003ccode\u003e.idx\u003c/code\u003e extension).\u003c/li\u003e\n\u003cli\u003eThe crafted subtitle file is specifically designed to declare an excessive number of distinct stream IDs beyond expected limits.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers the malicious subtitle file to a victim, typically alongside a video file, enticing them to play the media.\u003c/li\u003e\n\u003cli\u003eA media player or application that uses FFmpeg's VobSub demuxer attempts to parse the malicious subtitle file.\u003c/li\u003e\n\u003cli\u003eDuring the demuxing process, the \u003ccode\u003eff_subtitles_queue_insert()\u003c/code\u003e function within FFmpeg is invoked to handle the stream IDs.\u003c/li\u003e\n\u003cli\u003eDue to the overly large number of stream IDs in the malicious file, the function attempts to write data beyond the allocated boundary of the \u003ccode\u003evobsub-\u0026gt;q[]\u003c/code\u003e array.\u003c/li\u003e\n\u003cli\u003eThis action results in a heap buffer overflow, corrupting adjacent heap memory within the application's process.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages this memory corruption to achieve arbitrary code execution, gaining control over the compromised application and potentially the underlying system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-64830 leads directly to arbitrary code execution within any application that processes malicious VobSub subtitle files using vulnerable FFmpeg versions. The primary impact is the complete compromise of the affected application, allowing an attacker to execute commands, install malware, or exfiltrate sensitive data in the context of the user running the application. While the number of observed victims or specific sectors targeted is not detailed, this vulnerability broadly affects any system where FFmpeg is used to handle untrusted subtitle files, such as media servers, video editing software, or streaming platforms, making any user of such systems a potential target.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePrioritize patching FFmpeg to a version above 8.1.2 or applying relevant security updates to mitigate CVE-2026-64830.\u003c/li\u003e\n\u003cli\u003eEducate users to exercise caution when opening or importing subtitle files (\u003ccode\u003e.sub\u003c/code\u003e, \u003ccode\u003e.idx\u003c/code\u003e) from untrusted or unknown sources.\u003c/li\u003e\n\u003cli\u003eImplement application whitelisting to restrict the execution of unauthorized code that might be dropped or executed as a result of exploitation.\u003c/li\u003e\n\u003cli\u003eMonitor process creation events for media player applications (log source: process_creation) for unusual child processes, especially those related to shell execution or unexpected network connections.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T17:17:56Z","date_published":"2026-07-22T17:17:56Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-vobsub-heap-overflow/","summary":"FFmpeg versions 2.1 through 8.1.2 contain a heap buffer overflow vulnerability (CVE-2026-64830) in the VobSub subtitle demuxer, allowing attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file, potentially leading to arbitrary code execution in applications using FFmpeg's VobSub demuxer.","title":"FFmpeg VobSub Heap Buffer Overflow Vulnerability (CVE-2026-64830)","url":"https://feed.craftedsignal.io/briefs/2026-07-ffmpeg-vobsub-heap-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Media","version":"https://jsonfeed.org/version/1.1"}