CVE-2026-64834
HIGHFFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer
Title source: cnaDescription
FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.
References (3)
Core 3
Core References
Patch patch
Patch Commit
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer
Scores
CVSS v3
7.5
EPSS
0.0050
EPSS Percentile
40.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-835
Status
published
Products (3)
FFmpeg/FFmpeg
0.6.3 - 8.1.2
ffmpeg/ffmpeg
0.6.3 - 8.1.2
FFmpeg/FFmpeg
11d5f475be95d22d5f0692220cc772b116abc632
Published
Jul 22, 2026
Tracked Since
Jul 22, 2026