CyberRota Analysis
AI-GeneratedFFmpeg versions up to 9.0.2 are vulnerable to a denial of service attack via the DASH demuxer, where an attacker can exploit an empty SegmentTemplate media URL in a crafted .mpd manifest. This vulnerability can lead to an infinite loop in the get_current_fragment() function, resulting in excessive CPU consumption. Organizations using FFmpeg for media processing should prioritize patching to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.
Related CVEs
Other vulnerabilities affecting the same vendor(s)