Is CVE-2026-107678 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-107678?

CVE-2026-107678 has a CVSS v3 severity of MEDIUM (4.7).

Back

CVE-2026-107678

Description

FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.