CVE-2026-64834
Received Received - Intake

Infinite Loop in FFmpeg RTP/ASF Demuxer

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: VulnCheck

Description
FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-64834
EUVD
EUVD-2026-47758

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ffmpeg ffmpeg From 0.6.3 (inc) to 8.1.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an infinite loop flaw in FFmpeg versions 0.6.3 through 8.1.2 affecting the RTP/ASF demuxer. When processing a crafted RTP/ASF stream, the rtp_asf_fix_header function fails to validate a minimum chunksize. If the chunksize is smaller than 24 bytes, the loop pointer never advances, causing an infinite loop that exhausts CPU resources and denies service to legitimate users.

Detection Guidance

To detect this vulnerability, monitor network traffic for RTP/ASF streams using tools like Wireshark or tcpdump. Look for malformed packets with chunksize values smaller than 24 bytes. Inspect FFmpeg logs for excessive CPU usage or unresponsive processes during RTP/ASF stream processing.

Impact Analysis

This vulnerability allows remote attackers to cause a denial of service by sending a specially crafted RTP/ASF stream. This can lead to CPU exhaustion, rendering the system unresponsive or crashing, disrupting services that rely on FFmpeg for media processing.

Compliance Impact

This vulnerability primarily causes denial of service by exhausting CPU resources, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for resilience. HIPAA-covered entities might face disruptions in systems processing protected health information, affecting availability under the Security Rule.

Mitigation Strategies

Immediately update FFmpeg to the latest patched version. If updating is not possible, disable RTP/ASF demuxer functionality in FFmpeg configurations or block RTP/ASF streams at the network firewall level until patches are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64834. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart