CVE-2026-64834: FFmpeg RTP/ASF Demuxer DoS Vulnerability

CVE-2026-64834 Overview

CVE-2026-64834 is an infinite loop vulnerability in FFmpeg versions 0.6.3 through 8.1.2. The flaw resides in the RTP/ASF demuxer implemented in libavformat/rtpdec_asf.c. The rtp_asf_fix_header function iterates over Advanced Systems Format (ASF) objects without validating a minimum chunk size. Remote attackers can send a crafted RTP/ASF stream containing a chunk size smaller than the 24-byte ASF object header minimum. The loop pointer never advances, causing CPU exhaustion and denying service to legitimate users. The vulnerability is classified as [CWE-835] Loop with Unreachable Exit Condition.

Critical Impact
Remote unauthenticated attackers can trigger CPU exhaustion in FFmpeg-based media pipelines by sending a single crafted RTP/ASF stream, disrupting streaming and transcoding services.

Affected Products

FFmpeg 0.6.3 through 8.1.2
Applications and services that link libavformat and process RTP/ASF streams
Media servers and transcoders relying on affected FFmpeg builds

Discovery Timeline

2026-07-22 - CVE-2026-64834 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-64834

Vulnerability Analysis

The defect exists in FFmpeg's RTP demuxer for ASF payloads. The rtp_asf_fix_header function parses an ASF header stream by walking a sequence of ASF objects. Each object declares its own length in a chunksize field embedded in the object header. The parser advances its cursor by chunksize bytes on every iteration to reach the next object. The implementation does not enforce that chunksize is at least 24 bytes, which is the minimum valid ASF object header length. An attacker supplying a chunksize value of zero, or any value below 24, prevents the loop cursor from progressing past the current position. The parser then re-reads the same malformed header indefinitely, consuming 100% of a CPU core.

Root Cause

The root cause is missing input validation on an untrusted length field controlled by remote peers. The demuxer trusts the attacker-supplied chunksize without applying a lower bound sanity check before using it as a loop advancement value. This produces a classic unreachable-exit-condition loop, as described in [CWE-835].

Attack Vector

Exploitation requires only network access to a target that consumes RTP/ASF streams through FFmpeg. No authentication or user interaction is needed. An attacker crafts an RTP payload containing an ASF header where an embedded object declares a chunksize less than 24. When the target invokes rtp_asf_fix_header on the payload, the process enters an infinite loop and becomes unresponsive. Repeated delivery to multiple worker threads or processes can fully exhaust host CPU capacity.

No verified proof-of-concept code has been published. Technical details of the fix are available in the FFmpeg Commit Update and the associated FFmpeg Pull Request #23663.

Detection Methods for CVE-2026-64834

Indicators of Compromise

Sustained 100% CPU utilization by an FFmpeg process or a service linking libavformat immediately after receiving an RTP session
FFmpeg worker threads becoming unresponsive without crashing or emitting error messages
Increased latency or timeouts in downstream streaming, transcoding, or recording services
Inbound RTP/ASF traffic from untrusted or unexpected sources targeting media ingest endpoints

Detection Strategies

Inspect RTP/ASF payloads at the network boundary for ASF object headers declaring chunksize values below 24 bytes
Monitor process-level CPU time for ffmpeg and library consumers and alert on threads pinned at maximum utilization
Correlate RTP session initiation events with sudden CPU saturation on media servers
Review application logs for stalled demuxer operations that fail to produce frames or metadata

Monitoring Recommendations

Track per-process CPU and thread run-time metrics for media services and alert on sustained saturation
Log source IP addresses, ports, and payload sizes for all inbound RTP sessions on ingest hosts
Establish baseline transcoding throughput and alert on sudden drops that coincide with new RTP peers
Enable network flow logging on media ingress paths to support post-incident analysis

How to Mitigate CVE-2026-64834

Immediate Actions Required

Upgrade FFmpeg to a version that includes commit 11d5f475be95d22d5f0692220cc772b116abc632 from FFmpeg Pull Request #23663
Inventory all applications, containers, and appliances that bundle libavformat from FFmpeg 0.6.3 through 8.1.2
Restrict inbound RTP/ASF traffic to authenticated peers and known-good source networks
Enforce CPU and time limits on FFmpeg worker processes so infinite loops are terminated automatically

Patch Information

The upstream fix adds a minimum-size validation before advancing the loop cursor in rtp_asf_fix_header. Details are documented in the FFmpeg Commit Update and the VulnCheck Advisory on FFmpeg. Rebuild any statically linked or vendored copies of FFmpeg after applying the patch.

Workarounds

Disable the RTP/ASF demuxer in build configurations where ASF-over-RTP support is not required
Terminate RTP sessions at a proxy that validates ASF object headers before forwarding to FFmpeg
Apply process-level ulimit or cgroup CPU quotas so runaway workers are constrained and restarted
Isolate media ingest workloads in containers with strict resource ceilings to limit blast radius

bash

# Configuration example: cap FFmpeg CPU time and restart on exhaustion (systemd unit fragment)
[Service]
CPUQuota=100%
RuntimeMaxSec=300
Restart=on-failure
RestartSec=2