CVE-2026-107677
FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media
FFmpeg FFmpegLibraries & packages
CVSS
5.7MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.
Text from CVE List
Affected versions 1
- FFmpegaffected: all versions through 9.0.2CVE List
References 6
- code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592Fixvia CVE List
- code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778eFixvia CVE List
- vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-mediaAdvisoryvia CVE List
- github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238Referencevia CVE List
- github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726Referencevia CVE List
- ffmpeg.org/Referencevia CVE List