CVE-2026-107677: Ffmpeg: güvenlik açığı

Açıklama (NVD)

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.

Özet bilgiler

Ürün

Ffmpeg Ffmpeg

CVSS v3.1

4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v4.0

5.7 CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

%0,14 (yüzdelik 3)

CWE

CWE-835

Yama

Mevcut

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• code.ffmpeg.org
• code.ffmpeg.org
• ffmpeg.org
• github.com
• github.com
• www.vulncheck.com
• CWE-835