CVE-2026-107678 in FFmpeg
Summary
by MITRE • 10/08/2026
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in FFmpeg versions through 9.0.2 represents a critical resource exhaustion flaw located within the libavutil/encryption_info.c module, specifically affecting the av_encryption_init_info_free() function. This component is responsible for managing encryption initialization information structures that are parsed from multimedia container files. The core technical issue stems from an unbounded recursive execution pattern inherent in how these linked lists of AVEncryptionInitInfo objects are deallocated. When processing MOV format containers, the demuxer's mov_read_pssh() function constructs a linked list containing metadata for each pssh box found within the file structure. If this list becomes excessively large due to malicious input, the subsequent cleanup process triggers deep recursion that rapidly consumes available stack memory resources on the host system.
Attackers can exploit this weakness by crafting MP4 files that contain an abnormally high number of small pssh boxes, potentially numbering in the tens of thousands. Each additional box adds a node to the linked list managed by the encryption info handler. When FFmpeg attempts to free these structures after parsing or during cleanup operations, it invokes av_encryption_init_info_free() which traverses and deallocates nodes recursively rather than iteratively. This design choice fails to account for extreme input sizes typical of maliciously constructed media files, leading directly to stack exhaustion conditions that result in application crashes. The recursive nature of the deallocation logic means that memory usage scales linearly with depth but consumes significant stack space per frame due to function call overhead and local variable storage requirements inherent in deep recursion chains.
Beyond simple denial of service through process termination, this vulnerability introduces secondary performance degradation risks characterized by quadratic CPU consumption patterns under certain execution paths or system configurations where partial processing occurs before crash conditions are fully realized. The combination of excessive stack usage and potential computational waste during the traversal phase creates a potent vector for resource exhaustion attacks against services relying on FFmpeg for media transcoding, streaming, or analysis tasks. Such behavior aligns with CWE-789 which classifies memory allocation without proper bounds checking as a design flaw leading to denial of service conditions through resource depletion rather than arbitrary code execution in this specific context.
From an operational perspective, the impact extends beyond local application stability to potential remote exploitation scenarios where attackers target media processing servers or cloud-based transcoding pipelines that accept user-uploaded content. The ability to trigger crashes via specially crafted MP4 files allows adversaries to disrupt service availability for legitimate users and potentially obscure other malicious activities occurring within the same environment. This aligns with MITRE ATT&CK technique T1496 which describes resource hijacking through denial of service mechanisms aimed at degrading system performance or causing outages in critical infrastructure components that depend on robust media parsing capabilities.
Mitigation strategies must prioritize immediate patching to versions later than 9.0.2 where the recursive deallocation logic has been refactored to use iterative approaches with explicit stack management controls. Organizations should implement input validation layers at network perimeters or application gateways to limit the number of pssh boxes accepted in any single container file before it reaches FFmpeg processing engines. Additionally, deploying runtime protection mechanisms such as memory guard pages and strict resource quotas can help contain the blast radius if malformed inputs bypass initial filtering measures. Security teams should also consider enabling core dump analysis capabilities to monitor for stack overflow patterns indicative of this specific vulnerability class during incident response activities involving suspicious media file submissions or unusual CPU utilization spikes associated with video processing workloads.