High severity7.5NVD Advisory· Published Jul 22, 2026· Updated Jul 28, 2026

CVE-2026-64834

Description

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FFmpeg/Ffmpeg2 versions
cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*range: >=0.6.3,<=8.1.2
- (no CPE)range: 0.6.3 - 8.1.2
osv-coords3 versions
pkg:rpm/opensuse/ffmpeg-4&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/ffmpeg-7&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/ffmpeg-9&distro=openSUSE%20Tumbleweed
< 4.4.8-4.1+ 2 more
- (no CPE)range: < 4.4.8-4.1
- (no CPE)range: < 7.1.5-2.1
- (no CPE)range: < 9.0.1-2.1

Patches

Vulnerability mechanics

References

code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632nvdPatch
code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663nvdIssue TrackingPatch
www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxernvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000