Live › vulnerability › CVE-2026-120458
Kvazaar, a video encoder, loops forever when its command-line tool reads a Y4M file whose header lacks a terminating newline. An attacker who supplies such a file can keep the process busy at full CPU, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Teams that run the Kvazaar command-line encoder on .y4m files they did not create, such as video upload or transcoding services. Systems that only encode trusted local files, or do not use Kvazaar, can skip it. The sources do not say whether the library API is affected or only the command-line tool.
No product ranges from the sources yet.
kvazaar --version) and compare it with the versions the sources list as affected (through 2.3.2).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.
This page as .md · .json · in your agent: get_signal("CVE-2026-120458")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.