CVE-2026-64834

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
FFmpeg	FFmpeg	>= 0.6.3, <= 8.1.2; 11d5f475be95d22d5f0692220cc772b116abc632

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632Patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663Issue Tracking, Patch
https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxerThird Party Advisory

Timeline

Published: Jul 22, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-648358.8FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c t CVE-2026-648368.8ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root CVE-2026-648378.8ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject CVE-2026-648388.3ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated CVE-2026-64848.2In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.CVE-2026-648462.8Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimen CVE-2026-648476.8AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO CVE-2026-648499.3MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior CVE-2026-64858.2UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.CVE-2026-648508.7Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an edito CVE-2026-648518.5Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Pri CVE-2026-648528.7Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin