CVE-2026-107678: Ffmpeg

Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days.

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.

Affected products

• Ffmpeg Ffmpeg: up to and including 9.0.2

Published 2026-10-08. Last modified 2026-10-08.