CyberRota Analysis
AI-GeneratedFFmpeg versions up to 9.0.2 are vulnerable to a stack exhaustion issue in the av_encryption_init_info_free() function, which can be exploited by attackers through specially crafted MP4 files containing numerous small pssh boxes. This vulnerability can lead to process crashes and significant CPU resource consumption. Users and organizations utilizing FFmpeg for media processing should prioritize patching to mitigate potential denial-of-service attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.
Related CVEs
Other vulnerabilities affecting the same vendor(s)