CVE-2026-107677: FFmpeg DASH Demuxer DoS Vulnerability

CVE-2026-107677 Overview

CVE-2026-107677 is a denial of service vulnerability affecting FFmpeg through version 9.0.2. The flaw resides in the Dynamic Adaptive Streaming over HTTP (DASH) demuxer, which fails to validate an empty SegmentTemplate media URL inside a Media Presentation Description (.mpd) manifest. When FFmpeg parses a crafted manifest, the get_current_fragment() function invokes av_strireplace() with an empty search string, triggering an infinite loop and consuming CPU indefinitely. The weakness is tracked as CWE-835: Loop with Unreachable Exit Condition.

Critical Impact
Processing an attacker-supplied .mpd manifest causes an unbounded loop inside the FFmpeg DASH demuxer, resulting in sustained CPU exhaustion and denial of service for any application or pipeline relying on the library.

Affected Products

FFmpeg versions up to and including 9.0.2
Applications and services embedding the vulnerable libavformat DASH demuxer
Media processing pipelines that accept untrusted .mpd manifests

Discovery Timeline

2026-10-08 - CVE-2026-107677 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107677

Vulnerability Analysis

The defect lives in the FFmpeg DASH demuxer (libavformat/dashdec.c). When processing a representation, get_current_fragment() builds the fragment URL by substituting template placeholders in the SegmentTemplate media attribute. The substitution is delegated to av_strireplace() in libavutil/avstring.c. The function iterates over the input looking for occurrences of the search token and advances the cursor by the length of that token on each match. When the token is an empty string, the cursor never advances and the loop never terminates.

An attacker who can deliver a crafted .mpd manifest to a vulnerable FFmpeg instance forces a worker thread into a tight CPU-bound loop. The process stops servicing legitimate work, and additional malicious inputs can exhaust multi-core capacity.

Root Cause

The root cause is missing input validation on the media attribute of SegmentTemplate combined with an unsafe contract in av_strireplace(). The replacement helper does not guard against a zero-length search string, and the DASH demuxer does not reject manifests that declare media="". The combination satisfies the preconditions for CWE-835.

Attack Vector

Exploitation requires an attacker to supply a malicious manifest to a target that parses it with FFmpeg. Typical delivery paths include uploading media to transcoding services, feeding playlists to media players, or embedding references in web content consumed by server-side FFmpeg workers. Successful exploitation does not require authentication, but user or application interaction is needed to initiate parsing of the manifest.

Technical details are available in the VulnCheck advisory, the FFmpeg DASH demuxer source, and the av_strireplace() implementation.

Detection Methods for CVE-2026-107677

Indicators of Compromise

.mpd manifests containing a SegmentTemplate element with an empty media attribute (media="")
FFmpeg or ffprobe processes sustaining 100% CPU on a single core after loading a DASH manifest
Media processing jobs that never return and leave orphaned worker threads consuming CPU

Detection Strategies

Statically scan ingested manifests for SegmentTemplate elements missing a non-empty media attribute before passing them to FFmpeg
Apply execution timeouts and watchdogs around FFmpeg invocations and alert when a job exceeds its expected duration
Inventory FFmpeg installations and flag binaries at version 9.0.2 or earlier

Monitoring Recommendations

Collect per-process CPU and runtime telemetry for transcoding and streaming workers to identify runaway FFmpeg processes
Monitor queue depth and job completion rates in media pipelines for sudden stalls that correlate with manifest ingestion
Log the source and hash of every .mpd manifest processed to support incident scoping if an infinite loop is observed

How to Mitigate CVE-2026-107677

Immediate Actions Required

Upgrade FFmpeg beyond 9.0.2 once a tagged release containing commit ed27bfcb is available from the FFmpeg project
Reject or sanitize .mpd manifests from untrusted sources before invoking the DASH demuxer
Enforce strict CPU time and wall-clock limits on any process invoking FFmpeg to parse DASH content

Patch Information

The FFmpeg maintainers addressed the issue in pull request #24592 and merged the fix in commit ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e. The patch validates the SegmentTemplate media attribute and prevents av_strireplace() from entering an unbounded loop on empty search strings. Downstream distributions should backport this commit to any shipped version at or below 9.0.2.

Workarounds

Disable the DASH demuxer at build time or at runtime where DASH input is not required
Pre-validate manifests with a lightweight XML parser that rejects empty media attributes within SegmentTemplate
Run FFmpeg under a resource-controlled sandbox such as systemd-run with CPUQuota and RuntimeMaxSec enforced

bash

# Example: cap FFmpeg CPU and runtime to contain an infinite loop
systemd-run --scope \
  -p CPUQuota=50% \
  -p RuntimeMaxSec=30 \
  ffmpeg -i input.mpd -f null -