Description

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-07-22T18:17:05.780Z",
  "pubdate": "2026-07-22T18:17:05.780Z",
  "executiveSummary": "An infinite loop vulnerability exists in the RTP/ASF demuxer of FFmpeg versions 0.6.3 through 8.1.2, specifically within the libavformat/rtpdec_asf.c file. This flaw is classified as a Denial of Service (DoS) vulnerability caused by resource exhaustion.\nThe vulnerability allows remote attackers to cause a complete denial of service against systems processing media streams by transmitting a specially crafted RTP/ASF stream. The root mechanism involves the rtp_asf_fix_header function failing to validate a minimum chunksize constraint when iterating over Advanced Systems Format (ASF) objects.\nWhen an attacker supplies a chunksize smaller than the mandatory 24-byte minimum ASF object header size, the internal iteration pointer fails to advance. This forces the parsing routine into an unrecoverable infinite loop, resulting in 100% CPU utilization and immediate resource exhaustion.\nExploitation requires no authentication, privileges, or prior system access, as the vulnerability is triggered remotely over the network via standard media ingestion vectors. The risk implication is high for any application utilizing FFmpeg to ingest untrusted network streams, as a single malicious stream can disrupt service availability for legitimate users.",
  "technicalDetails": "The vulnerability resides in libavformat/rtpdec_asf.c within the rtp_asf_fix_header function of FFmpeg, affecting versions 0.6.3 through 8.1.2. The vulnerable component is responsible for parsing and repairing ASF headers encapsulated within RTP packets.\nThe root cause of the vulnerability is the absence of strict input validation regarding the minimum chunksize of ASF objects during header iteration. Standard ASF specifications dictate that object headers maintain a minimum size of 24 bytes to accommodate the object identifier and size fields. However, the rtp_asf_fix_header function fails to verify whether parsed chunk sizes adhere to this 24-byte boundary.\nThe attack flow proceeds as follows: an unauthenticated remote attacker transmits a malicious RTP/ASF stream containing a crafted payload over the network to a target running a vulnerable FFmpeg build. When the libavformat module processes the incoming stream, control is passed to the rtp_asf_fix_header function to iterate through the embedded ASF objects.\nDuring the iteration loop, the parser encounters a crafted chunk with a declared size smaller than the required 24-byte minimum. Because the size validation logic is missing, the pointer offset calculations fail to increment properly or evaluate to a non-progressing state. Consequently, the loop condition evaluates to true indefinitely without consuming new data or advancing the stream pointer.\nThis execution behavior induces a tight CPU-bound infinite loop, leading to immediate CPU exhaustion on the host system. The affected worker thread or process consumes maximum CPU resources, preventing the application from servicing legitimate requests and effectively denying service. Due to network exposure of media ingestion endpoints, remote attackers can easily trigger this condition repeatedly to sustain the denial of service."
}