CVE-2026-107677Published
FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-107677 · Microsoft / collected KEV context
cve-program · CVE-2026-107677
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592
- https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726
- https://ffmpeg.org/
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.