PT-2026-108039 · FFmpeg · Ffmpeg
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H |
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av encryption init info free() in libavutil/encryption info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov read pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.
Fix
Uncontrolled Recursion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ffmpeg