Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107678FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes

Medium 4.7

In plain English

A medium-severity security flaw in FFmpeg from FFmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)<0.1%top 99.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ffmpeg	no fix listed	DEBIAN-CVE-2026-107678
Debian:13	ffmpeg	no fix listed	DEBIAN-CVE-2026-107678
Debian:14	ffmpeg	no fix listed	DEBIAN-CVE-2026-107678
Ubuntu:26.10	ffmpeg	no fix listed	UBUNTU-CVE-2026-107678

Affected products (as reported)

Vendor	Product	Versions
FFmpeg	FFmpeg	0 – through 9.0.2

Weakness: CWE-674 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593 issue-tracking
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavutil/encryption_info.c#L219-L231 technical-description
https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/mov.c#L8070 technical-description
https://ffmpeg.org/ product
VulnCheck Advisory: FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes third-party-advisory