CVE-2026-107677

MEDIUM 4.7CVE-2026-107677 · Published 08/10/2026 · updated 14/10/2026

Package	Affected versions	Patched versions
ffmpeg ffmpeg	`≤ 9.0.2`	No fix yet

Description

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.

References

code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e · Patch
code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592 · Issue Tracking
ffmpeg.org · Product
FFmpeg/FFmpeg · Product
FFmpeg/FFmpeg · Product
vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free