Kvazaar
Monthly
Denial of service in the Kvazaar HEVC command-line encoder through 2.3.2 lets an attacker hang the encoder by supplying a crafted .y4m input whose header is truncated and lacks the terminating newline (0x0A); getc() then returns EOF without being checked, so the parse loop in read_header() never makes progress and the process spins indefinitely on a full CPU core. The flaw is local in nature - it requires an operator to run the encoder on attacker-supplied input (UI:P), needs no privileges (PR:N), and produces no confidentiality or integrity impact, only high availability impact. A public PoC reference exists in the form of a published writeup; it is not verified as working exploit code, and there is no KEV confirmation of active exploitation. The only complete fix per the available evidence is updating to code containing the upstream parser rewrite.
Denial of service in the Kvazaar HEVC command-line encoder through 2.3.2 lets an attacker hang the encoder by supplying a crafted .y4m input whose header is truncated and lacks the terminating newline (0x0A); getc() then returns EOF without being checked, so the parse loop in read_header() never makes progress and the process spins indefinitely on a full CPU core. The flaw is local in nature - it requires an operator to run the encoder on attacker-supplied input (UI:P), needs no privileges (PR:N), and produces no confidentiality or integrity impact, only high availability impact. A public PoC reference exists in the form of a published writeup; it is not verified as working exploit code, and there is no KEV confirmation of active exploitation. The only complete fix per the available evidence is updating to code containing the upstream parser rewrite.