Cyber Resilience

CVE-2026-64834

DoS in Ffmpeg 0.6.3 – 8.1.2

Public PoCDoS
Published
22 July 2026
Modified
28 July 2026
Patch / advisory
View advisory
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0050 40th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-64834 is a high-severity Infinite Loop (CWE-835) vulnerability in Ffmpeg Ffmpeg. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 40th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize…

more

when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.

CWE(s)
CWE-835

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Infinite loop in FFmpeg RTP/ASF demuxer directly enables remote DoS via crafted stream causing CPU exhaustion, matching application exploitation for endpoint denial of service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1499.004 Application or System Exploitation Impactconfidence: HIGH
Infinite loop in RTP/ASF demuxer from crafted stream directly enables application exploitation for denial of service via CPU exhaustion.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-30998Same product: Ffmpeg Ffmpeg
CVE-2026-30999Same product: Ffmpeg Ffmpeg
CVE-2026-30997Same product: Ffmpeg Ffmpeg
CVE-2023-46407Same product: Ffmpeg Ffmpeg
CVE-2023-6601Same product: Ffmpeg Ffmpeg
CVE-2024-32230Same product: Ffmpeg Ffmpeg
CVE-2025-25469Same product: Ffmpeg Ffmpeg
CVE-2024-36615Same product: Ffmpeg Ffmpeg
CVE-2024-32228Same product: Ffmpeg Ffmpeg
CVE-2024-22860Same product: Ffmpeg Ffmpeg

Affected Assets

ffmpeg
ffmpeg
0.6.3 — 8.1.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-5 Denial-of-service Protection
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of input fields such as chunksize in the RTP/ASF demuxer to reject malformed headers smaller than the 24-byte minimum and prevent the infinite loop.

SC-5 Denial-of-service Protection partial match
prevent

Provides denial-of-service protection mechanisms that can throttle or drop crafted RTP/ASF streams before they exhaust CPU in the rtp_asf_fix_header loop.

SI-2 Flaw Remediation good match
prevent

Mandates timely patching of the identified flaw in libavformat/rtpdec_asf.c so that the missing minimum-chunksize check is implemented in deployed FFmpeg versions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (reviews, testing, static analysis) directly prevent introduction of infinite-loop defects.

ID.RA-01 partial match
prevents

Static analysis and vuln scanning during asset assessment can detect unreachable loop exits.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can uncover infinite-loop conditions before release.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle mandates practices that can detect and prevent infinite-loop defects.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify loop-termination rules, indirectly reducing the weakness.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly address loop termination and prevent infinite loops.

A.8.27 Secure system architecture and engineering principles none match
none

Secure architecture principles encourage designs that avoid unreachable exit conditions.

A.8.32 Change management none match
none

Change management can require review of loop logic when code is modified.

References