CVE-2026-64834

Name of the Vulnerable Software and Affected Versions FFmpeg versions 0.6.3 through 8.1.2

Description An infinite loop exists in the RTP/ASF demuxer within libavformat/rtpdec asf.c. This occurs because the rtp asf fix header() function does not validate a minimum chunksize when iterating over ASF objects. If a chunksize is smaller than the 24-byte minimum ASF object header size, the loop pointer fails to advance, leading to CPU exhaustion and a denial of service when processing a crafted RTP/ASF stream.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.