CVE-2026-107677: FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so getcurrentfragment() calls avstrireplace() with an empty search string, consuming CPU indefinitely.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the denial of service?
An attacker must induce processing of a crafted DASH .mpd manifest whose SegmentTemplate declares an empty media attribute, such as media="". Processing that manifest can cause an infinite loop and sustained CPU consumption.
Is this remotely exploitable without user interaction?
No. The supplied vector is AV:L and UI:R, indicating the affected FFmpeg process must locally process attacker-controlled content and user interaction is required.
What impact should operators expect if exploitation succeeds?
The impact is denial of service through indefinite CPU consumption. The provided metrics indicate no confidentiality or integrity impact, while availability impact is high.