FFmpeg CVE-2026-107678

Exploitation requires FFmpeg (through 9.0.2) to parse an attacker-supplied MP4/MOV file whose moov structure contains tens of thousands of small 'pssh' (Protection System Specific Header) boxes; the MOV demuxer's mov_read_pssh() builds an AVEncryptionInitInfo linked list that av_encryption_init_info_free() then frees recursively, exhausting the stack. No authentication or privileges are needed (PR:N), but exploitation is limited by: (1) user/victim interaction to feed the file into FFmpeg (UI:P), (2) the local processing vector (AV:L) - the attacker needs their file to reach an FFmpeg decode/demux path, and (3) high complexity (AC:H/AT:P) stemming from the need to generate a large, specifically-structured box count and the quadratic cost. Impact is limited to availability (process crash and CPU exhaustion) with no code execution or data exposure.

This is a genuinely medium-severity denial-of-service issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H) scores 5.7 and correctly reflects an availability-only impact (process crash via stack exhaustion, CWE-674 uncontrolled recursion) with no confidentiality or integrity exposure and no code execution. The vector itself tempers the severity: the attack is local (AV:L), carries high complexity and an attack requirement (AC:H/AT:P, reflecting the need to craft tens of thousands of nested pssh boxes and the quadratic-cost dependency), and requires user/victim interaction (UI:P) to feed the crafted MP4 into FFmpeg. There is no CISA KEV listing and no public exploit code identified in the provided sources (only a vendor advisory and the upstream fix PR), so exploitation status is 'no public exploit identified at time of analysis.' No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified here. The one caveat worth flagging: the CVE assigns AV:L, but FFmpeg frequently processes untrusted media received over the network (streaming, upload pipelines, transcoding services); in those deployments the practical reachability is closer to remote-triggered than the AV:L label implies - verify against your actual deployment. Net: a real but modest priority - worth patching in media-processing pipelines, not an emergency.

An attacker crafts a malicious MP4 file containing tens of thousands of small PSSH boxes and submits it to a service or user that transcodes or inspects it with FFmpeg (e.g., an upload/transcoding pipeline). When the MOV demuxer parses the boxes and av_encryption_init_info_free() recursively frees the resulting linked list, the deep recursion exhausts the stack and crashes the process, with additional quadratic CPU consumption. No public exploit code is identified, but the crafting technique is straightforward to reproduce.