CVE-2026-107677 in FFmpeg
Summary
by MITRE • 10/08/2026
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in FFmpeg versions through 9.0.2 resides within the Dynamic Adaptive Streaming over HTTP demuxer module, specifically affecting how manifest files are parsed and processed during media playback initialization. This component is responsible for interpreting MPEG-DASH manifests to determine where media segments should be fetched from a remote server. The core technical flaw stems from an improper validation of input parameters passed to string manipulation functions within the internal logic that resolves segment URLs. When processing a DASH manifest, the demuxer extracts various template strings defined by the SegmentTemplate element to construct actual URIs for downloading audio or video chunks. In this specific instance, the code fails to adequately check whether critical components of these templates are empty before proceeding with string replacement operations.
The exploitation mechanism relies on an attacker crafting a malicious MPEG-DASH Presentation Description file that declares a SegmentTemplate media attribute set to an empty string rather than providing a valid relative or absolute path. When FFmpeg processes this manifest, it attempts to resolve the current fragment by invoking internal helper functions designed for URL templating. One such function calls av_strireplace with an empty search string argument. In many standard library implementations and custom parsing routines within multimedia frameworks, passing an empty pattern to a replace operation can result in undefined behavior or infinite iteration because the logic may attempt to insert the replacement value at every possible position between characters, including positions that do not exist when the input is also empty or malformed. This results in an unbounded loop that consumes CPU resources indefinitely without terminating naturally.
From an operational perspective, this vulnerability constitutes a denial of service condition rather than a remote code execution risk. An attacker who can force a victim to parse and process the crafted manifest file will cause the FFmpeg instance to hang permanently on one or more processor cores. This behavior is particularly dangerous in server-side environments where FFmpeg is used for transcoding, streaming relay, or automated media processing pipelines. A single malicious request targeting such services could exhaust available CPU cycles, leading to service degradation for legitimate users and potentially causing system-wide instability if resource limits are not strictly enforced at the operating system level. Clients using FFmpeg as a library in desktop applications may experience frozen interfaces requiring manual termination of the process by the user or administrator.
This flaw aligns with CWE-835, which describes loops that do not terminate correctly due to logic errors involving boundary conditions and empty inputs. It also relates to CWE-20 regarding improper input validation where the application fails to verify that data meets expected constraints before processing. In terms of offensive security frameworks, this vulnerability maps to MITRE ATT&CK technique T1496, which covers Resource Hijacking via denial of service attacks against specific applications or services. The attack vector is classified as remote with low complexity because it requires only the delivery of a text-based manifest file, often achievable through phishing emails, malicious websites hosting DASH streams, or compromised content distribution networks that serve untrusted media metadata to unsuspecting players.
Mitigation strategies for this vulnerability involve upgrading FFmpeg to version 9.0.3 or later where the issue has been addressed by adding explicit checks for empty strings before invoking string replacement functions. For environments unable to upgrade immediately, implementing strict input validation at the application layer is recommended. Developers integrating FFmpeg should ensure that any manifest files processed are sanitized against known malicious patterns, specifically checking SegmentTemplate attributes for emptiness or invalid characters prior to passing them to the demuxer. Additionally, deploying resource monitoring tools can help detect abnormal CPU usage spikes associated with such infinite loops, allowing for automated process termination before significant service disruption occurs. Security teams should also review their media ingestion pipelines to ensure that only trusted sources are allowed to provide DASH manifests and consider implementing timeouts or sandboxing mechanisms to limit the impact of potential exploitation attempts.