CVE-2026-107678 FFmpeg CVE debrief

Who should care

System administrators and developers using FFmpeg in their applications, especially those processing untrusted input, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

The vulnerability in FFmpeg through version 9.0.2 can lead to a denial of service and high CPU consumption. System administrators and developers should assess their exposure and take necessary actions to mitigate the vulnerability.

• Potential denial of service due to stack crash
• High CPU consumption leading to performance degradation
• Need for verification of FFmpeg installations and patching

Technical summary

The vulnerability is caused by the recursive freeing of AVEncryptionInitInfo linked lists in the av_encryption_init_info_free() function in libavutil/encryption_info.c. This can be triggered by a crafted MP4 file with a large number of small pssh boxes, leading to a stack crash and high CPU consumption. The vulnerability affects FFmpeg through version 9.0.2 and can lead to a denial of service and high CPU consumption. System administrators and developers should assess their exposure and take necessary actions to mitigate the vulnerability, especially in environments where untrusted input is processed.

Defensive priority

Medium priority should be given to verifying and patching FFmpeg installations, especially in environments where untrusted input is processed.

Recommended defensive actions

• Verify FFmpeg installations and apply patches or updates as available
• Review and monitor input sources for crafted MP4 files
• Consider implementing additional security measures to prevent exploitation
• Perform vulnerability assessment to identify potential exposure
• Review system logs for signs of exploitation
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the vulnerability, including its cause and potential impact. However, there is limited information on the actual exploitation and affected systems. Defenders should verify FFmpeg installations, review input sources, and consider additional security measures. The vulnerability can be triggered by a crafted MP4 file with a large number of small pssh boxes, leading to a stack crash and high CPU consumption. There is a need for verification of FFmpeg installations and patching, especially

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.