CVE-2026-64834 in FFmpeg
Summary
by MITRE • 07/22/2026
FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability represents a critical denial of service flaw affecting FFmpeg versions ranging from 0.6.3 through 8.1.2, specifically within the RTP/ASF demuxer component located in libavformat/rtpdec_asf.c. The issue stems from inadequate input validation mechanisms that fail to properly enforce minimum chunksize requirements during ASF object processing. When a remote attacker crafts a malicious RTP/ASF stream with intentionally small chunksize values, the rtp_asf_fix_header function enters an infinite loop scenario where the iteration pointer fails to advance past the malformed data structures.
The technical execution of this vulnerability occurs through the improper handling of ASF (Advanced Systems Format) object headers within the RTP streaming context. The demuxer routine expects each ASF object to contain a minimum 24-byte header structure that defines object properties including size and type information. However, when an attacker submits a stream containing chunks with sizes smaller than this minimum requirement, the loop control mechanism becomes trapped in an infinite iteration pattern. This condition arises because the code does not implement proper bounds checking or early termination conditions when encountering invalid chunksize values that fall below the expected header size threshold.
The operational impact of this vulnerability manifests as complete system resource exhaustion, particularly affecting CPU utilization and overall system responsiveness. Legitimate users attempting to process valid RTP/ASF streams become unable to access the service due to the malicious stream causing the application to consume excessive computational resources. This denial of service condition affects not only individual FFmpeg processes but can potentially compromise entire systems that rely on this multimedia processing library for streaming, transcoding, or playback operations. The vulnerability's remote exploitability means that attackers need not be physically present to cause disruption, making it particularly dangerous in networked environments.
This flaw aligns with CWE-835, which specifically addresses the issue of infinite loops in software implementations, and demonstrates how inadequate input validation can lead to resource exhaustion attacks. From an ATT&CK framework perspective, this vulnerability maps to T1499.004, covering the exploitation of resource exhaustion through malformed input processing, and represents a classic example of how protocol parsing errors can be weaponized for denial of service attacks. The vulnerability's persistence across multiple FFmpeg versions indicates a fundamental design flaw that required comprehensive code review and patching efforts to address properly. Organizations utilizing FFmpeg in production environments should prioritize immediate remediation through version updates and implement network-level filtering to prevent malicious RTP/ASF streams from reaching vulnerable systems, while also considering input sanitization measures at the application layer to provide additional defense-in-depth protection against similar vulnerabilities.