Infinite Loop Vulnerability in FFmpeg's RTP/ASF Demuxer
CVE-2026-64834

8.7HIGH

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
22 July 2026

What is CVE-2026-64834?

FFmpeg has a vulnerability in its RTP/ASF demuxer located in libavformat/rtpdec_asf.c, where crafted RTP/ASF streams can trigger an infinite loop. This issue arises because the rtp_asf_fix_header function does not validate the minimum chunksize appropriately. When a chunksize falls below the required 24-byte minimum for ASF object headers, the loop pointer fails to progress. As a result, this could lead to excessive CPU usage, ultimately causing service disruption for legitimate users.

Affected Version(s)

FFmpeg 0.6.3 <= 8.1.2

FFmpeg 0.6.3 <= 8.1.2

FFmpeg 11d5f475be95d22d5f0692220cc772b116abc632

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663
issue-tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95...
patch
https://www.vulncheck.com/advisories/ffmpeg-infinite-loop...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pavel Kohout, Aisle Research
.