CVE-2026-7739: tsMuxer Denial of Service Vulnerability

CVE-2026-7739 Overview

CVE-2026-7739 affects justdan96 tsMuxer up to version 2.7.0, an open-source utility for muxing transport streams. The flaw resides in the HevcVpsUnit::setFPS function inside /AFLplusplus/tsMuxer_prev/tsMuxer/hevc.cpp. Manipulating the track_id argument triggers improper resource shutdown or release [CWE-404], leading to denial of service. The attack requires local access and low privileges. A public proof-of-concept exists, but the product line is no longer supported by the maintainer, so no official patch will be issued.

Critical Impact
Local attackers can crash the tsMuxer process by supplying a crafted HEVC track identifier, disrupting media muxing workflows on affected systems.

Affected Products

justdan96 tsMuxer versions up to and including 2.7.0
The HevcVpsUnit::setFPS parser in tsMuxer/hevc.cpp
Unsupported tsMuxer builds bundled in third-party media toolchains

Discovery Timeline

2026-05-04 - CVE-2026-7739 published to NVD
2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-7739

Vulnerability Analysis

The vulnerability is a denial-of-service condition in the High Efficiency Video Coding (HEVC) parsing logic of tsMuxer. When HevcVpsUnit::setFPS processes a malformed or unexpected track_id argument, the function fails to release or properly manage resources tied to the Video Parameter Set (VPS) unit. This improper resource shutdown [CWE-404] causes the muxing process to terminate or hang. Because the bug is reachable through local user-supplied media inputs, an attacker who can deliver a crafted HEVC stream to a workflow that invokes tsMuxer can reliably crash the parser.

Root Cause

The root cause is improper resource handling inside HevcVpsUnit::setFPS when the track_id value falls outside expected boundaries. tsMuxer does not validate or sanitize the track identifier before using it to manage VPS-related state, so resources are not released in the expected order. The defect was identified through fuzzing under AFL++, as indicated by the /AFLplusplus/tsMuxer_prev/ path embedded in the disclosure.

Attack Vector

Exploitation requires local access and low-privileged code execution on the host. An attacker supplies a crafted HEVC input file that, when processed by tsMuxer, exercises the vulnerable code path in hevc.cpp. The result is a process crash or hang rather than code execution. A public proof-of-concept archive (poc1.zip) is referenced in GitHub Issue #895, demonstrating the crash with a sample input.

No verified code examples are available; refer to the tsMuxer GitHub repository and VulDB #360914 for technical details.

Detection Methods for CVE-2026-7739

Indicators of Compromise

Unexpected crashes or aborts of the tsMuxer or tsMuxerGUI process during HEVC track processing
Core dumps referencing HevcVpsUnit::setFPS or hevc.cpp in the call stack
Suspicious HEVC input files originating from untrusted sources placed in media processing directories

Detection Strategies

Monitor for repeated abnormal terminations of tsMuxer binaries on workstations and media servers
Inspect HEVC sample files for malformed VPS NAL units or anomalous track_id fields prior to processing
Correlate process termination events with the user account that submitted the input file

Monitoring Recommendations

Enable host-level process telemetry to capture exit codes and crash signals from media muxing tools
Log file provenance for HEVC inputs ingested into automated muxing pipelines
Alert when tsMuxer is executed by non-standard users or from unexpected directories

How to Mitigate CVE-2026-7739

Immediate Actions Required

Discontinue use of justdan96 tsMuxer 2.7.0 and earlier in production media workflows where untrusted HEVC content is processed
Restrict execution of tsMuxer to trusted operators and validated input directories
Sandbox tsMuxer processes so a crash does not impact upstream automation

Patch Information

No official patch is available. The maintainer no longer supports the affected versions, as noted in VulDB #360914. Organizations should evaluate migration to a supported alternative or apply community-maintained forks that address the parser defect. Track upstream activity through GitHub Issue #895.

Workarounds

Pre-validate HEVC inputs with a separate parser to reject malformed VPS units before invoking tsMuxer
Run tsMuxer inside a container or jail with strict resource limits and automatic restart policies
Limit local access to systems running tsMuxer through standard endpoint hardening and least-privilege controls

bash

# Configuration example: run tsMuxer with resource limits and restricted user
sudo -u tsmuxer-svc \
  systemd-run --scope \
    -p MemoryMax=512M \
    -p CPUQuota=50% \
    -p NoNewPrivileges=yes \
    /usr/local/bin/tsMuxeR /input/job.meta /output/job.ts