UBUNTU-CVE-2026-120458: Medium severity ubuntu/kvazaar vulnerability
Kvazaar through 2.3.2 contains an infinite loop vulnerability in readheader() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems are exposed when the Kvazaar command-line encoder processes Y4M files supplied by an untrusted party. Exploitation requires a local attack vector and user interaction, such as having someone run the encoder against the crafted file.
What does an attacker need to provide?
The attacker needs to supply a crafted .y4m file with a truncated Y4M header that lacks a terminating newline. Processing that file can cause the encoder to loop indefinitely and consume a full CPU core.
How can I determine whether my installation is affected?
The issue affects Kvazaar through version 2.3.2. Check the installed version of the Ubuntu kvazaar package and whether it is used to encode potentially untrusted Y4M input.
What can be done before a fix is available?
Do not pass untrusted Y4M files to the command-line encoder, and validate that Y4M headers are complete and newline-terminated before encoding. Where untrusted input must be processed, use execution controls that can terminate hung encoder processes and limit CPU consumption.