Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck
CVE-2026-120458Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser
Medium 5.5
In plain English
A medium-severity infinite loop in Kvazaar from Ultra Video Group. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 94.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:26.04:LTS | kvazaar | no fix listed | UBUNTU-CVE-2026-120458 |
| Ubuntu:26.10 | kvazaar | no fix listed | UBUNTU-CVE-2026-120458 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ultra Video Group | Kvazaar | 0 – through 2.3.2 |
Weakness: CWE-835 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- https://github.com/ultravideo/kvazaar/issues/452 issue-tracking
- https://github.com/ultravideo/kvazaar/commit/8a2f109be283e87008c679d635966cc034da39c6 patch
- https://github.com/ultravideo/kvazaar/blob/v2.3.2/src/encmain.c#L339-L357 technical-description
- Kvazaar v2.3.2 Release Notes release-notes
- https://hackmd.io/@haindpwn/kvazaar-y4m-header-missing-newline-infinite-loop technical-description
- VulnCheck Advisory: Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser third-party-advisory
- https://hackmd.io/@haindpwn/cve-2026-120458-kvazaar-y4m-header-missing-newline-infinite-loop exploit