The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade ffmpeg (Ubuntu Pro)Upgrade libavformat62 (Ubuntu Pro)Upgrade libavcodec58 (Ubuntu Pro)Upgrade libavcodec-ffmpeg-extra56 (Ubuntu Pro)Upgrade libavformat-extra62 (Ubuntu Pro)Upgrade libavfilter11 (Ubuntu Pro)Upgrade libavcodec-extra60 (Ubuntu Pro)Upgrade libavformat58 (Ubuntu Pro)Upgrade libavcodec62 (Ubuntu Pro)Upgrade libavformat-extra58 (Ubuntu Pro)Upgrade libavcodec-extra57 (Ubuntu Pro)Upgrade libavfilter7 (Ubuntu Pro)Upgrade libavcodec57 (Ubuntu Pro)Upgrade libavfilter-ffmpeg5 (Ubuntu Pro)Upgrade libavformat57 (Ubuntu Pro)Upgrade libavformat-extra60 (Ubuntu Pro)Upgrade libavcodec-extra62 (Ubuntu Pro)Upgrade libavcodec-ffmpeg56 (Ubuntu Pro)Upgrade libavfilter9 (Ubuntu Pro)Upgrade libavfilter6 (Ubuntu Pro)Upgrade libavformat60 (Ubuntu Pro)Upgrade libavcodec60 (Ubuntu Pro)Upgrade libavcodec-extra58 (Ubuntu Pro)Upgrade libavformat-ffmpeg56 (Ubuntu Pro) | Sep 14, 2026 | Sep 3, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub