CVE-2026-107678: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-107678 is a stack exhaustion vulnerability in FFmpeg through version 9.0.2, classified as a Denial of Service (DoS) issue. The flaw resides in the av_encryption_init_info_free() function in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists constructed by the MOV demuxer's mov_read_pssh() function. An attacker can supply a crafted MP4 file containing tens of thousands of small pssh boxes to exhaust the call stack and crash the process, while simultaneously causing quadratic CPU consumption. It was disclosed on October 8, 2026, with a CVSS v3.1 score of 4.7 (Medium) and a CVSS v4.0 score of 5.7 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is uncontrolled recursion (CWE-674) combined with allocation of resources without limits or throttling (CWE-770). The av_encryption_init_info_free() function in libavutil/encryption_info.c (lines 219–231) recursively calls itself to traverse and free a linked list of AVEncryptionInitInfo nodes — one recursive call per node — without any depth limit. The MOV demuxer's mov_read_pssh() function (around libavformat/mov.c line 8070) builds this linked list by appending one node per pssh box encountered in an MP4 file. By embedding tens of thousands of minimal pssh boxes in a crafted MP4, an attacker can force a recursion depth that exhausts the thread's stack, causing a crash; the quadratic CPU consumption arises from the nested processing of these boxes during demuxing (Github Advisory, FFmpeg Source).

Successful exploitation results in a process crash (stack overflow) and severe CPU degradation due to quadratic resource consumption, constituting a complete availability impact on the affected FFmpeg process. There is no confidentiality or integrity impact — the vulnerability is purely a Denial of Service. Applications and services that automatically process user-supplied or remotely fetched MP4 files using FFmpeg (e.g., media transcoding pipelines, video streaming platforms, multimedia players) are at risk of service disruption (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim or automated system must open or process the crafted MP4 file — and the attack vector is local (the file must be accessible to the FFmpeg process). The EPSS score is approximately 0.077–0.094%, indicating a low near-term exploitation probability (Github Advisory). No threat actor attribution has been reported.

1. Craft a malicious MP4 file: Create an MP4 file containing tens of thousands of minimal pssh (Protection System Specific Header) boxes. Each pssh box can be small (minimal valid size), as the goal is quantity rather than size — the MOV demuxer will append one AVEncryptionInitInfo node per pssh box to a linked list.
2. Deliver the file to the target: Provide the crafted MP4 to a system running a vulnerable FFmpeg version (≤ 9.0.2). This could be via file upload to a media processing service, a shared directory, a download link, or any mechanism that causes FFmpeg to open the file.
3. Trigger FFmpeg processing: Cause FFmpeg to demux or transcode the file (e.g., ffmpeg -i malicious.mp4 ...). The MOV demuxer's mov_read_pssh() will parse each pssh box and build a deeply nested AVEncryptionInitInfo linked list.
4. Stack exhaustion occurs: When FFmpeg attempts to free the linked list via av_encryption_init_info_free(), the recursive calls — one per node — exhaust the thread stack, causing a segmentation fault or stack overflow crash. Simultaneously, quadratic CPU consumption degrades system performance during the demuxing phase.
5. Denial of Service achieved: The FFmpeg process crashes, disrupting any dependent service or pipeline (Github Advisory, FFmpeg Source).

• Process: FFmpeg process terminating abnormally with a segmentation fault (SIGSEGV) or stack overflow signal (SIGABRT) when processing MP4 files; unusually high CPU utilization sustained during MP4 demuxing.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing FFmpeg crash with stack overflow or segfault; application logs recording failed media processing jobs for specific MP4 inputs.
• File System: Presence of crafted MP4 files with an abnormally large number of pssh boxes (detectable via MP4 analysis tools such as mp4info, MP4Box, or ffprobe showing excessive pssh atom counts).
• Network: Unusual inbound file uploads or downloads of MP4 files to media processing endpoints, particularly files that are small in size but trigger disproportionate CPU usage.

The upstream fix is tracked in FFmpeg pull request #24593; users should update to a version of FFmpeg beyond 9.0.2 once a patched release is available (FFmpeg PR). As an interim workaround, restrict FFmpeg from processing MP4 files sourced from untrusted or external parties, and implement input validation or pre-screening to detect and reject MP4 files with an excessive number of pssh boxes. Monitoring for abnormal CPU consumption during media file processing can help detect exploitation attempts. Red Hat has tracked this issue for affected packages (Red Hat Bugzilla).

Red Hat has filed a bug report (Bug 2548033) and is tracking the issue across affected packages, indicating awareness among enterprise Linux distributors (Red Hat Bugzilla). The Yocto Project security mailing list has also referenced the vulnerability, suggesting downstream embedded Linux communities are monitoring it. No significant public researcher commentary or social media discussion has been identified at this time.