CVE-2026-107677

Name	CVE-2026-107677
Description	FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ffmpeg (PTS)	bookworm, bookworm (security)	7:5.1.9-0+deb12u1	vulnerable
	trixie (security), trixie	7:7.1.5-0+deb13u1	vulnerable
	forky	7:9.0.2-1	vulnerable
	sid	7:9.0.2-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ffmpeg	source	(unstable)	(unfixed)

Notes

[trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592
Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e (master)