CVE-2026-107678
Received Received - Intake

Stack Exhaustion in FFmpeg via Malicious MP4 File

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: VulnCheck

Description
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-107678
EUVD
EUVD-2026-95083

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FFmpeg FFmpeg 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack exhaustion issue in FFmpeg through version 9.0.2. It occurs in the function av_encryption_init_info_free() which recursively frees linked lists of AVEncryptionInitInfo structures created by the MOV demuxer's mov_read_pssh() function. Attackers can exploit this by providing a crafted MP4 file with many small pssh boxes, causing stack exhaustion and process crashes. The vulnerability also leads to high CPU usage due to quadratic time complexity during the recursive freeing process.

Detection Guidance

Detecting this vulnerability requires analyzing MP4 files for excessive pssh boxes. Use FFmpeg to process suspicious files with commands like 'ffmpeg -i input.mp4 -f null -' to check for crashes or hangs. Monitor system resources during playback for abnormal CPU or memory usage.

Impact Analysis

If exploited, this vulnerability can crash applications using vulnerable FFmpeg versions when processing malicious MP4 files. It may lead to denial-of-service conditions, system slowdowns due to high CPU consumption, and potential instability of media processing software. Users could experience application freezes or unexpected terminations when opening specially crafted files.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA. It is a stack exhaustion issue in FFmpeg that could lead to denial of service or increased resource usage, but it does not involve unauthorized data access, processing, or disclosure that would typically trigger GDPR or HIPAA violations.

Mitigation Strategies

Upgrade FFmpeg to a patched version beyond 9.0.2. Avoid processing untrusted MP4 files until patched. Implement file validation to block files with excessive pssh boxes. Monitor for crashes or high CPU usage during media processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107678. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart