EUVD-2026-26922Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local system access
-
DeliveryAuthenticate as privileged user
-
ExploitExecute tsMuxer with crafted track_id input
-
ExecutionTrigger HevcVpsUnit::setFPS validation failure
-
ImpactApplication crash and denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires: (1) local access to the system running tsMuxer (AV:L prevents remote exploitation), (2) valid user credentials with at least standard-level privileges (PR:L), (3) the ability to invoke tsMuxer directly or supply input to a process running tsMuxer, and (4) tsMuxer version 2.7.0 or earlier must be installed. No special product configuration or non-default settings are mentioned as prerequisites - the vulnerability exists in the default implementation of the HevcVpsUnit::setFPS function. Exploitation does NOT require user interaction (UI:N) beyond initial execution, meaning automated or scripted attacks are feasible against affected instances. |
| Impact | This vulnerability presents minimal real-world risk despite public exploit availability. The CVSS 1.9 score reflects multiple limiting factors: local-only access requirement (AV:L), authenticated user prerequisite (PR:L), and low privilege threshold (PR:L) significantly restrict the attack surface. The impact is limited to availability only (VA:L), with no confidentiality or integrity compromise possible. EPSS exploitation probability is not provided, but the combination of low CVSS, local-only access requirement, and the stated fact that affected versions are no longer supported by the maintainer suggests this is a low-priority issue. The presence of publicly available POC does not materially increase risk given the stringent access prerequisites. Organizations should prioritize patching or upgrading over this vulnerability compared to network-accessible flaws. |
| Exploit ScenarioDerived | A local authenticated user with standard privileges obtains the publicly available POC exploit (available at https://github.com/user-attachments/files/16812270/poc1.zip) and executes it against a system running tsMuxer 2.7.0. The exploit supplies a malformed track_id value to the HevcVpsUnit::setFPS function, causing the application to crash and denying service to legitimate tsMuxer operations. This scenario requires the attacker to already have local shell access and valid user credentials on the target system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 04, 2026
Denial of service in tsMuxer up to version 2.7.0 via improper input validation in the HevcVpsUnit::setFPS function allows local authenticated attackers to crash the application by manipulating the track_id argument. The vulnerability affects only unsupported product versions and carries a very low CVSS score (1.9), though publicly available exploit code exists.
RemediationAI
The most effective remediation is to upgrade tsMuxer to a version newer than 2.7.0 if available from the justdan96 GitHub repository (https://github.com/justdan96/tsMuxer/). Since the vulnerability description indicates affected versions are no longer supported by the maintainer, users should verify whether newer unsupported-maintenance releases or community forks provide fixes. As a compensating control, restrict local access to tsMuxer by limiting user accounts with execution privileges on systems running the application, though this may impact legitimate workflow automation. Additionally, monitor tsMuxer process execution logs for unexpected crashes or error conditions that might indicate exploitation attempts. Given the low CVSS score and local-only attack vector, organizations not running tsMuxer as a service or in shared-access environments face negligible practical risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
tsMuxer is a video multiplexing utility that processes HEVC (H.265) video streams. The vulnerability resides in the HevcVpsUnit::setFPS function within hevc.cpp, which handles frame rate configuration for HEVC video parameter sets. The flaw is categorized under CWE-404 (Improper Resource Validation), indicating that the function fails to properly validate the track_id parameter before using it in a way that triggers a denial of service condition. The attack vector is local (AV:L), requiring an authenticated user with low privileges (PR:L) to supply crafted input that causes the application to malfunction or crash.
Know when Tsmuxer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in justdan96 tsMuxer up to 2.7.0. This vulnerability affects the function HevcVpsUnit::setFPS of the file /AFLplusplus/tsMuxer_prev/tsMuxer/hevc.cpp. This manipulation of the argument track_id causes denial of service. The attack requires local access. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function HevcSpsUnit::short_term_ref_pic_
tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bi
A heap-based buffer overflow in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service
A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service
A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service
A negative-size-param in tsMuxer version nightly-2024-04-05-01-53-02 allows attackers to cause Denial of Service (DoS) v
A heap-based buffer overflow in tsMuxer version nightly-2024-05-10-02-00-45 allows attackers to cause Denial of Service
A stack-based buffer over-read in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Information Disc
A heap-based buffer under-read in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Servic
A memory leak in tsMuxer version git-2539d07 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
tsMuxer v2.6.16 was discovered to contain a heap overflow via the function BitStreamWriter::flushBits() at /tsMuxer/bitS
Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the applicat
Exploit-DB