CVE-2026-120458: Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser

Published Nov 2, 2026

Updated

Kvazaar through 2.3.2 contains an infinite loop vulnerability in readheader() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.

Affected Software

2 affected components

ubuntu/kvazaar*

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Nov 3, 2026

Data Sourced

via OSV·12:00 AM

Affected Software

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems that run the Kvazaar command-line encoder on Y4M files from untrusted or insufficiently validated sources are exposed. A local user or workflow able to supply the encoder input can cause the affected encoding process to hang.

What does an attacker need to provide to trigger the denial of service?

The attacker needs to supply a crafted .y4m file with a truncated Y4M header that lacks a terminating newline. The vulnerable header parser performs unchecked EOF reads and enters an infinite loop.

What is the operational impact of successful exploitation?

The command-line encoder hangs indefinitely and consumes a full CPU core. The provided data does not indicate impact beyond availability of the affected encoder process.

What can be done if an update cannot be applied immediately?

Avoid processing untrusted Y4M input, or validate that Y4M headers are complete and newline-terminated before passing files to Kvazaar. Limit CPU resources and apply execution timeouts to encoder jobs to reduce the impact of a hung process.

CVE-2026-120458: Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to provide to trigger the denial of service?

What is the operational impact of successful exploitation?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to provide to trigger the denial of service?

What is the operational impact of successful exploitation?

What can be done if an update cannot be applied immediately?