Infinite Loop Vulnerability in Kvazaar Command-Line Encoder
CVE-2026-120458
6.8MEDIUM
What is CVE-2026-120458?
Kvazaar versions up to 2.3.2 contain an infinite loop vulnerability within the read_header() function, specifically in src/encmain.c. This vulnerability can be exploited by attackers who provide a maliciously crafted .y4m file that omits a terminating newline. As a result, the encoder enters an infinite loop, leading to unchecked EOF reads that freeze the process and consume an entire CPU core. This behavior creates a denial of service condition, rendering the command-line encoder inoperative until manually terminated.
Affected Version(s)
Kvazaar 0 <= 2.3.2
References
CVSS V4
Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology
Marko Viitanen (fador)