Bug 2508218

Summary:	CVE-2026-64834 ffmpeg: Denial of Service via crafted RTP/ASF stream [fedora-43]
Product:	[Fedora] Fedora	Reporter:	Joel Chamberlain <jochambe>
Component:	ffmpeg	Assignee:	Multimedia SIG <multimedia-sig>
Status:	ASSIGNED ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	43	CC:	asn, development.group, dominik, multimedia-sig, ngompa13
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["99872afe-b436-42d9-a6fe-aa5067835544"]}
Fixed In Version:	ffmpeg-9.0.1-1.fc46,ffmpeg-9.0.1-4.fc45,ffmpeg-8.1.3-1.fc44	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Joel Chamberlain 2026-07-28 20:32:50 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.

Comment 1 Aoife Moloney 2026-08-17 15:39:56 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.

Comment 2 Dominik 'Rathann' Mierzejewski 2026-09-28 11:40:51 UTC

Fixed in:
9.0:   https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c441711a343ccf50196c70a3f0b554b52f8d9de
8.1.3: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c26e3cd2f879dc7bea3d0ee00dc5353f7bc9842d

NOT fixed in 7.1.x.

Comment 3 Fedora Update System 2026-09-28 11:41:25 UTC

FEDORA-2026-3e109a0c85 (ffmpeg-8.1.3-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e109a0c85

Comment 4 Fedora Update System 2026-09-29 02:11:01 UTC

FEDORA-2026-3e109a0c85 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-3e109a0c85`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3e109a0c85

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2026-10-01 01:11:53 UTC

FEDORA-2026-3e109a0c85 (ffmpeg-8.1.3-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.