CVE-2026-64834

EUVD-2026-47758

22.07.2026, 18:17

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.

Infinite Loop

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 41.02%

Affected Products (NVD)

Vendor	Product	Version
ffmpeg	ffmpeg	0.6.3 ≤ 𝑥 ≤ 8.1.2

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	vulnerable
bookworm (security)	vulnerable
bullseye	vulnerable
bullseye (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	postponed
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

bionic	Fixed 7:3.4.11-0ubuntu0.1+esm15 released
focal	Fixed 7:4.2.7-0ubuntu0.1+esm16 released
jammy	Fixed 7:4.4.2-0ubuntu0.22.04.1+esm15 released
noble	Fixed 7:6.1.1-3ubuntu5+esm13 released
resolute	needed
xenial	Fixed 7:2.8.17-0ubuntu0.1+esm17 released

libav

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libavcodec-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavcodec57

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavformat-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavformat57

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavresample3

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise workstation 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libavutil55

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libpostproc-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libpostproc54

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswresample-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswresample2

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswscale-devel

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

libswscale4

suse enterprise desktop 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise sap 15 SP7	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP4	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP5	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP6	3.4.2-150200.11.79.1 fixed
suse enterprise server 15 SP7	3.4.2-150200.11.79.1 fixed

Common Weakness Enumeration

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Vulnerability Media Exposure

[GERMAN] ffmpeg: Mehrere Schwachstellen
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ffmpeg ausnutzen, um beliebigen Code auszuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.
Published: 2026-07-22T22:00:00+00:00

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663

https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer