CVE-2026-120458 in Kvazaar
Summary
by MITRE • 11/02/2026
Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Kvazaar versions through 2.3.2 represents a critical denial of service risk stemming from improper input validation within the video encoding pipeline. Specifically, the flaw resides in the read_header function located in the src/encmain.c source file. This component is responsible for parsing metadata and configuration data before initiating the actual compression process. When processing Y4M format files, which are commonly used as raw uncompressed video inputs for encoders, the software fails to adequately handle edge cases related to file termination. The core technical deficiency involves an infinite loop triggered by a truncated or malformed header structure that lacks the expected terminating newline character. Instead of detecting this anomaly and aborting with an appropriate error code, the parser enters a state where it continuously attempts to read from the end-of-file stream without proper boundary checks.
From a technical perspective, this behavior classifies as CWE-835, which denotes a loop that consumes resources indefinitely due to missing or incorrect termination conditions. The attacker exploits this by crafting a .y4m file with specific structural deficiencies, particularly omitting the final newline in the header section. Upon ingestion of such a crafted input, the encoder's parsing logic fails to recognize the end of valid data and proceeds into an unbounded read operation. This results in the process hanging indefinitely while consuming one full CPU core. The impact is immediate and severe for any system relying on automated video processing pipelines, as the hung process can block subsequent tasks, exhaust available computational resources, or cause service degradation depending on how the encoder is integrated into larger applications.
In terms of operational impact, this vulnerability allows a remote or local attacker to perform a denial-of-service attack with minimal effort and no authentication requirements if the input source is untrusted. The resource consumption aspect aligns with ATT&CK technique T1496, which covers Resource Hijacking through CPU exhaustion. By forcing the encoder into an infinite loop, the attacker effectively monopolizes processing power, potentially leading to system instability or failure of dependent services that rely on timely video encoding outputs. This is particularly dangerous in cloud environments or shared hosting scenarios where resource limits are not strictly enforced at the application level before execution begins.
Mitigation strategies should focus primarily on updating to a patched version of Kvazaar released after 2.3.2, which includes fixes for input validation and EOF handling within the header parsing logic. For systems unable to update immediately, implementing strict file format validation prior to feeding data into the encoder can serve as an effective defense-in-depth measure. This involves verifying that Y4M headers contain all required fields including proper termination characters before passing them to the vulnerable function. Additionally, deploying resource monitoring tools that detect abnormal CPU usage spikes associated with encoding processes can help in early detection and automated remediation of such hangs. Ensuring that input sources are sanitized and validated against known good formats significantly reduces the attack surface for this type of logic error exploitation.