Bug 2548036 (CVE-2026-107677)
| Summary: | CVE-2026-107677 ffmpeg: ffmpeg: Denial of Service via empty SegmentTemplate in DASH demuxer | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | bbrownin |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in FFmpeg. An attacker could cause a Denial of Service (DoS) by supplying a specially crafted media presentation description (.mpd) manifest containing an empty media segment URL. When processed by the Dynamic Adaptive Streaming over HTTP (DASH) demuxer, this input triggers an infinite loop, consuming excessive CPU resources and causing the application to become unresponsive.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2549552, 2549555, 2549556, 2549557, 2549559, 2549566 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-08 15:56:43 UTC
|