---
id: CVE-2026-107677
title: >-
  FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH
  demuxer that allows attackers to trigger an infinite loop by supplying an
  empty SegmentTemplate media URL
summary: >-
  FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH
  demuxer that allows attackers to trigger an infinite loop by supplying an
  empty SegmentTemplate media URL. Attackers can craft an .mpd manifest
  declaring Segment…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H'
cwe:
  - CWE-835
vendor: FFmpeg
product: FFmpeg
affected:
  - FFmpeg <= 9.0.2
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:04:38.633'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107677'
references:
  - url: >-
      https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e
    label: disclosure@vulncheck.com
  - url: 'https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592'
    label: disclosure@vulncheck.com
  - url: 'https://ffmpeg.org/'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/dashdec.c#L1726'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/avstring.c#L230-L238
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-dash-demuxer-infinite-loop-via-empty-segmenttemplate-media
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T16:00:16.353750Z'
ingestedAt: '2026-10-08T15:49:37.997Z'
---

## Overview

FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.