CVE-2026-120458
Received Received - Intake

Kvazaar Infinite Loop in Y4M Header Processing

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120458

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Ultra Video Group Kvazaar 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kvazaar through version 2.3.2 has an infinite loop vulnerability in the Y4M header parser. When a crafted .y4m file lacks a terminating newline, the read_header() function in src/encmain.c enters an infinite loop while reading the header byte by byte. The loop fails to check for EOF, causing it to hang indefinitely while consuming a full CPU core.

Detection Guidance

To detect this vulnerability, monitor for processes consuming 100% CPU indefinitely when processing Y4M files. Check for Kvazaar versions up to 2.3.2 using commands like 'kvazaar --version' or 'dpkg -l | grep kvazaar'. Test with a crafted Y4M file missing a trailing newline to observe the infinite loop behavior.

Impact Analysis

This vulnerability can disrupt services processing untrusted Y4M files by causing a denial-of-service. The infinite loop consumes CPU resources indefinitely, potentially hanging the command-line encoder and affecting system performance. Automated transcoding services are particularly vulnerable.

Compliance Impact

This vulnerability primarily causes a denial-of-service (DoS) condition by hanging the Kvazaar encoder indefinitely, consuming CPU resources. It does not directly impact data confidentiality, integrity, or privacy, which are key concerns for GDPR and HIPAA. However, if the encoder is used in systems processing sensitive data (e.g., video surveillance, medical imaging), a DoS could disrupt services, potentially leading to delays in data processing or access, which may indirectly affect compliance with availability requirements in these regulations.

Mitigation Strategies

Upgrade Kvazaar to the latest version (2.3.2 or higher) which includes fixes for the Y4M header parser. If upgrading is not possible, restrict access to Kvazaar to trusted users only and avoid processing untrusted Y4M files. Implement input validation to ensure Y4M files contain proper headers with terminating newlines.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120458. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...