Kvazaar EUVD-2026-115218

Requires an operator to run the Kvazaar command-line encoder (through 2.3.2) on an attacker-supplied .y4m file (UI:P); it is not remotely triggerable on its own. The specific trigger stated in the sources is a crafted Y4M header that is truncated and lacks the terminating newline (0x0A), causing getc() in read_header() to return EOF without being checked so the parse loop never makes progress. Limiting factors that reduce realistic risk: local attack vector only, dependence on the victim actually processing untrusted .y4m input, no authentication bypass and no code execution - impact is confined to availability (process hang and one CPU core consumed). The only complete fix per the evidence is updating to the patched code; no alternative mitigation is stated by the vendor.

This is a denial-of-service-only flaw (CWE-835 infinite loop) in the Kvazaar command-line HEVC encoder, and the signals are consistent in pointing to modest real-world risk. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 but describes a purely local, availability-only impact: no confidentiality or integrity loss, and it requires an operator to actually feed the crafted file to the encoder (UI:P). It is NOT listed in CISA KEV, so there is no confirmed active exploitation, and no EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified here. The vuln.today decision label is 'this_month' - meaningful but not an emergency - which aligns with a local DoS in a specialized tool rather than a remotely exploitable critical. The only amplifying signal is a public write-up describing the exact mechanism (a truncated Y4M header lacking the terminating newline causing unchecked EOF reads), which lowers the effort to reproduce. Net: a genuine availability bug worth patching on a normal cadence, not a high-urgency remote threat; the headline 6.8 overstates practical danger because the vector is local and impact is confined to hanging a single process.

In an automated transcoding or research pipeline that runs Kvazaar on externally supplied .y4m inputs, an attacker submits a crafted .y4m file whose YUV4MPEG2 header is truncated and lacks the terminating newline (0x0A). When the operator or pipeline invokes the encoder on it, read_header() in src/encmain.c spins on unchecked EOF reads and hangs indefinitely while pinning a full CPU core. A public technical write-up of the issue exists (hackmd), lowering reproduction effort, though no verified weaponized exploit is indicated.