CVE-2026-7740: tsMuxer Denial of Service Vulnerability

CVE-2026-7740 Overview

CVE-2026-7740 is a local denial of service vulnerability in justdan96 tsMuxer up to version 2.7.0. The flaw resides in the VvcVpsUnit::setFPS function within tsMuxer/vvc.cpp. Manipulation of the track_id argument leads to abnormal program termination, classified under [CWE-404] Improper Resource Shutdown or Release. The exploit was disclosed publicly and a proof-of-concept archive is available. The vendor no longer supports the affected product line, so no official patch is expected. Attackers must have local access to trigger the condition, limiting practical impact to scenarios where untrusted input is processed by tsMuxer.

Critical Impact
Local attackers supplying a crafted Versatile Video Coding (VVC) track can crash tsMuxer, disrupting muxing workflows on systems running unsupported versions up to 2.7.0.

Affected Products

justdan96 tsMuxer versions up to and including 2.7.0
The VvcVpsUnit::setFPS function in tsMuxer/vvc.cpp
Product line is no longer supported by the maintainer

Discovery Timeline

2026-05-04 - CVE-2026-7740 published to NVD
2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-7740

Vulnerability Analysis

tsMuxer is an open-source utility for muxing elementary streams into transport stream and Blu-ray containers. The vulnerability lives in the VVC (Versatile Video Coding, H.266) handling path. Specifically, the VvcVpsUnit::setFPS method in tsMuxer/vvc.cpp mishandles the track_id argument supplied during processing. When a malformed or unexpected value reaches the function, tsMuxer fails to release or validate resources correctly, causing the process to terminate.

The weakness maps to [CWE-404] Improper Resource Shutdown or Release. The impact is limited to availability — the data confidentiality and integrity of the host are not affected. Because exploitation requires local access and authenticated user privileges, the vulnerability is constrained to workflows where tsMuxer ingests attacker-controlled media files.

Root Cause

The root cause is improper handling of the track_id parameter inside VvcVpsUnit::setFPS. The function does not enforce sufficient bounds or state checks before operating on the associated track structure. A maliciously formed input causes the muxer to release or dereference an invalid resource, which terminates the process.

Attack Vector

A local attacker delivers a crafted media file or invokes tsMuxer with parameters that drive the VVC parser into the vulnerable code path. Because the attack vector is local and requires low privileges with no user interaction, exploitation is limited to environments where tsMuxer processes untrusted media. The publicly disclosed proof-of-concept archive demonstrates the crash. See GitHub tsMuxer Issue #899 and the GitHub PoC Attachment for the reported reproduction details.

Detection Methods for CVE-2026-7740

Indicators of Compromise

Unexpected termination of tsMuxer or tsMuxerGUI processes shortly after opening a media file
Presence of crafted VVC/H.266 sample files in download or shared media directories
Repeated process crash entries referencing vvc.cpp or VvcVpsUnit::setFPS in application or system logs

Detection Strategies

Monitor process exit codes and crash dumps generated by tsMuxer to identify abnormal terminations linked to VVC parsing
Inspect media files queued for muxing for malformed VPS (Video Parameter Set) NAL units in VVC tracks
Correlate tsMuxer crashes with the source of the input file, flagging files received from untrusted users or public sources

Monitoring Recommendations

Enable application crash reporting on workstations running tsMuxer to capture stack traces referencing vvc.cpp
Track command-line invocations of tsMuxer that include unusual track_id values or unexpected automation
Audit shared media ingestion pipelines for files that consistently trigger muxer failures

How to Mitigate CVE-2026-7740

Immediate Actions Required

Discontinue use of tsMuxer versions up to 2.7.0 in automated or shared workflows where untrusted input is processed
Restrict tsMuxer execution to trusted user accounts and isolated systems
Validate or sanitize media files from external sources before submitting them to tsMuxer

Patch Information

No official vendor patch is available. The advisory states that this vulnerability only affects products no longer supported by the maintainer. Organizations should evaluate alternative muxing tools or community forks. Reference the GitHub tsMuxer Repository and VulDB Vulnerability #360915 for the latest disclosure status.

Workarounds

Run tsMuxer inside a sandbox or container to contain process crashes and limit access to host resources
Pre-screen input media with a separate parser to reject malformed VVC streams before muxing
Replace tsMuxer with an actively maintained alternative for production muxing pipelines

bash

# Configuration example: run tsMuxer under a restricted user with resource limits
sudo -u tsmuxer-restricted \
  systemd-run --scope \
  --property=MemoryMax=1G \
  --property=TasksMax=64 \
  /opt/tsmuxer/tsMuxer /sandbox/input.meta /sandbox/output.m2ts