FFmpeg CVE-2026-107677

Exploitation requires FFmpeg's DASH demuxer to process an attacker-controlled .mpd manifest that declares a SegmentTemplate element with an empty media attribute (media=""); this empty search string drives av_strireplace() (called from get_current_fragment() in dashdec.c) into an unbounded loop. Limiting factors: a victim must actively open or stream the malicious manifest (user interaction / content-processing required, per UI:P), only applications that invoke the DASH demuxer are affected, and impact is confined to availability (CPU exhaustion / process hang) with no code execution, data disclosure, or integrity impact. Versions at or below FFmpeg 9.0.2 are affected; the fixed build removes the condition.

This is a medium-severity availability-only flaw (CWE-835 infinite loop) and the signals are internally consistent rather than conflicting. The vendor CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P, VA:H, VC:N/VI:N) scores 5.7 and describes exactly what the vulnerability is: no confidentiality or integrity impact, only CPU/availability loss, and it depends on a victim processing attacker-supplied content (UI:P) plus a specific attack condition (AT:P). No EPSS score was provided in the input and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation; exploitation status is best described as no public exploit identified at time of analysis (a VulnCheck advisory and a root-cause writeup exist, but an advisory describing the crafting steps is not the same as confirmed weaponized exploit code). One genuine tension: the vendor chose AV:L, yet DASH .mpd manifests are an HTTP adaptive-streaming format normally delivered over the network, so in applications that stream a remote manifest the realistic vector is closer to AV:N - verify how your deployment feeds manifests to FFmpeg. Net: this is a real but bounded denial-of-service priority - worth patching promptly because FFmpeg is extremely widely embedded, but it is not a drop-everything issue since there is no RCE, no data exposure, and no confirmed in-the-wild exploitation.

An attacker hosts or delivers a malicious DASH manifest (.mpd) that declares a SegmentTemplate with media="" (empty media URL). When a victim application or user loads that manifest through FFmpeg's DASH demuxer, get_current_fragment() calls av_strireplace() with an empty search string and spins in an infinite loop, pinning a CPU core and hanging the media process. No public exploit code is identified at the time of analysis, though the vendor advisory documents the trigger in enough detail to reproduce it.