CVE-2026-107678: FFmpeg Stack Exhaustion DOS Vulnerability

CVE-2026-107678 Overview

CVE-2026-107678 is a stack exhaustion vulnerability in FFmpeg through version 9.0.2. The flaw resides in av_encryption_init_info_free() within libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh() function. An attacker can craft an MP4 file containing tens of thousands of small pssh boxes to exhaust the process stack and crash FFmpeg. The same input also triggers quadratic CPU consumption during parsing. The issue is categorized under [CWE-674] Uncontrolled Recursion.

Critical Impact
A single malformed MP4 file can crash any application using FFmpeg's libavformat to parse untrusted media, disrupting transcoding pipelines and media services.

Affected Products

FFmpeg versions up to and including 9.0.2
Applications linking libavutil and libavformat from affected FFmpeg builds
Media processing pipelines that accept MP4/MOV input from untrusted sources

Discovery Timeline

2026-10-08 - CVE-2026-107678 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107678

Vulnerability Analysis

The vulnerability is a denial-of-service condition caused by uncontrolled recursion during cleanup of parsed media metadata. When FFmpeg's MOV demuxer processes an MP4 file, mov_read_pssh() in libavformat/mov.c parses Protection System Specific Header (pssh) boxes and builds a singly linked list of AVEncryptionInitInfo structures. The teardown routine av_encryption_init_info_free() traverses this list recursively, invoking itself once per node rather than iterating. A file containing tens of thousands of pssh boxes forces the recursion depth to match the list length, exhausting the thread stack and terminating the process. Parsing the same input also exhibits quadratic time complexity.

Root Cause

The root cause is the recursive implementation of av_encryption_init_info_free() at lines 219-231 of libavutil/encryption_info.c. The function frees the current node and then calls itself on info->next instead of walking the list with a loop. Combined with the absence of any upper bound on the number of pssh boxes accepted by mov_read_pssh(), attacker-controlled input directly determines recursion depth.

Attack Vector

Exploitation requires local delivery of a crafted MP4 file and user interaction to invoke an FFmpeg-based tool against it. The attacker constructs a container with many thousands of small pssh atoms inside the moov box. When any consumer, such as ffmpeg, ffprobe, or a server-side transcoder, opens the file, the demuxer builds the oversized list and the cleanup path triggers stack overflow. No authentication is required, but the impact is limited to availability of the parsing process. See the VulnCheck Advisory on FFmpeg for additional context.

No verified public proof-of-concept code is available. Technical details on the vulnerable code paths are documented in FFmpeg Code Reference - mov.c and FFmpeg Code Reference - encryption_info.c.

Detection Methods for CVE-2026-107678

Indicators of Compromise

MP4 or MOV files whose moov atom contains an unusually high count of pssh boxes, often tens of thousands of small entries.
Crash reports from ffmpeg, ffprobe, or linked applications showing stack overflow termination during container demuxing.
Sustained high CPU usage by media processing workers immediately followed by abnormal process exit.

Detection Strategies

Inspect inbound media with a safe parser or mp4dump and flag files whose pssh box count exceeds a conservative threshold such as 64.
Monitor transcoding and streaming services for repeated worker crashes correlated with specific uploaded assets.
Review process exit codes and core dumps on hosts running FFmpeg to identify SIGSEGV events originating in av_encryption_init_info_free.

Monitoring Recommendations

Enable container runtime restart counters and alert on elevated restart rates for FFmpeg-based workloads.
Capture telemetry on media ingestion endpoints, including file size, atom structure, and processing duration per asset.
Forward application and system logs to a central analytics platform to correlate crash signatures with source accounts and upload paths.

How to Mitigate CVE-2026-107678

Immediate Actions Required

Inventory all systems and container images that bundle FFmpeg 9.0.2 or earlier, including transcoding servers, media CDNs, and desktop tools.
Restrict FFmpeg processing of MP4/MOV input to sandboxed workers with constrained CPU and memory budgets.
Reject or quarantine user-submitted media that exceeds expected structural limits prior to invoking FFmpeg.

Patch Information

The fix is tracked in FFmpeg Pull Request #24593, which converts the recursive free into an iterative traversal. Upgrade to the patched FFmpeg release once your distribution ships it, and rebuild downstream applications that statically link libavutil. Monitor the FFmpeg Official Website for release announcements.

Workarounds

Pre-screen MP4 files with a lightweight parser and drop any containing more than a small, well-defined number of pssh boxes.
Run FFmpeg under a process supervisor with automatic restart and per-job timeouts to contain crashes.
Increase the thread stack size for FFmpeg workers as a short-term buffer; this reduces reliability of exploitation but does not eliminate the quadratic CPU cost.

bash

# Example: raise worker stack size and apply CPU/time limits before invoking ffmpeg
ulimit -s 65536
ulimit -t 30
timeout 30s ffmpeg -i "$INPUT" -f null - 2>ffmpeg.log || echo "ffmpeg failed on $INPUT"