CVE-2026-120458
Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.
| CWE | CWE-835 |
| Vendor | ultra video group |
| Product | kvazaar |
| Published | Nov 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for ultra video group kvazaar
Be the first to know when new medium vulnerabilities affecting ultra video group kvazaar are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Ultra Video Group / Kvazaar
0 ≤ 2.3.2
References
github.com: https://github.com/ultravideo/kvazaar/issues/452 github.com: https://github.com/ultravideo/kvazaar/commit/8a2f109be283e87008c679d635966cc034da39c6 github.com: https://github.com/ultravideo/kvazaar/blob/v2.3.2/src/encmain.c#L339-L357 github.com: https://github.com/ultravideo/kvazaar/releases/tag/v2.3.2 hackmd.io: https://hackmd.io/@haindpwn/kvazaar-y4m-header-missing-newline-infinite-loop vulncheck.com: https://www.vulncheck.com/advisories/kvazaar-through-2.3.2-infinite-loop-dos-via-y4m-header-parser
Credits
HaiND from the Post and Telecommunication Institute of Technology Marko Viitanen (fador)