{"id":"CVE-2026-120458","kind":"vulnerability","aliases":["CVE-2026-120458"],"related":[],"title":"Kvazaar: truncated Y4M header makes the encoder hang forever","description":"Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.","summary":"Kvazaar, a video encoder, loops forever when its command-line tool reads a Y4M file whose header lacks a terminating newline. An attacker who supplies such a file can keep the process busy at full CPU, a denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["command-line","kvazaar","package","video-encoding"],"not_affected_if":["no-kvazaar-installed","trusted-input-only"],"how_to_check":"- Check the installed Kvazaar version (`kvazaar --version`) and compare it with the versions the sources list as affected (through 2.3.2).\n- Look for places where the command-line encoder is run on untrusted .y4m files, such as upload or transcoding pipelines.","fix":"- Kvazaar: unknown; the sources link a patch and release notes but do not state the fixed version in the text provided.","status":"open","published_at":"2026-11-02T15:17:29+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","triaged_at":"2026-11-02T15:26:14+00:00","updated_at":"2026-11-02T15:26:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T15:26:14Z","model":"claude-haiku-5-5","output":{"fix":"- Kvazaar: unknown; the sources link a patch and release notes but do not state the fixed version in the text provided.","reach":"unknown","title":"Kvazaar: truncated Y4M header makes the encoder hang forever","impact":"low","summary":"Kvazaar, a video encoder, loops forever when its command-line tool reads a Y4M file whose header lacks a terminating newline. An attacker who supplies such a file can keep the process busy at full CPU, a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["kvazaar","video-encoding","command-line"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Encoder process hangs indefinitely, consuming a full CPU core","analyst_note":"Confirm the fixed Kvazaar version and whether the library API, not just the CLI, is affected, using the linked patch and release notes.","how_to_check":"- Check the installed Kvazaar version (`kvazaar --version`) and compare it with the versions the sources list as affected (through 2.3.2).\n- Look for places where the command-line encoder is run on untrusted .y4m files, such as upload or transcoding pipelines.","plain_action":"","needs_analyst":true,"not_affected_if":["no-kvazaar-installed","trusted-input-only"],"who_is_affected":"Teams that run the Kvazaar command-line encoder on .y4m files they did not create, such as video upload or transcoding services. Systems that only encode trusted local files, or do not use Kvazaar, can skip it. The sources do not say whether the library API is affected or only the command-line tool.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4208,"output_tokens":605,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120458':12A,15A '-2026':11A,14A '2.3.2':67C 'allow':79C 'attack':47B,80C,94C 'busi':57B 'caus':105C 'command':17B,33B,85C 'command-lin':16B,32B,84C 'consum':115C 'contain':68C 'core':119C 'cpu':60B,118C 'craft':98C 'cve':10A,13A 'denial':62B 'encod':7A,23B,27B,87C 'eof':107C 'file':39B,52B,100C 'forev':9A,29B 'full':59B,117C 'hang':8A,82C,110C 'header':4A,41B,75C,93C 'indefinit':113C 'infinit':70C 'keep':54B 'kvazaar':1A,19B,24B,65C 'lack':42B,101C 'line':18B,34B,86C 'loop':28B,71C 'make':5A 'newlin':45B,104C 'packag':20B 'process':56B,112C 'provid':96C 'read':36B,74C,108C 'servic':64B 'src/encmain.c':77C 'suppli':49B,89C 'termin':44B,103C 'tool':35B 'truncat':2A,91C 'uncheck':106C 'video':22B,26B 'video-encod':21B 'vulner':72C 'whose':40B 'y4m':3A,38B,92C,99C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the Kvazaar command-line encoder on .y4m files they did not create, such as video upload or transcoding services. Systems that only encode trusted local files, or do not use Kvazaar, can skip it. The sources do not say whether the library API is affected or only the command-line tool.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["commandline","kvazaar","medium","package","videoencoding"],"first_public_at":"2026-11-02T15:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120458","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120458","severity":null,"published_at":"2026-11-02T15:17:29+00:00","modified_at":"2026-11-02T15:17:29+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","fetched_at":"2026-11-02T15:24:03+00:00","note":null}],"documents":[{"id":52513,"url":"https://github.com/ultravideo/kvazaar/commit/8a2f109be283e87008c679d635966cc034da39c6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52514,"url":"https://github.com/ultravideo/kvazaar/releases/tag/v2.3.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":52515,"url":"https://www.vulncheck.com/advisories/kvazaar-through-2.3.2-infinite-loop-dos-via-y4m-header-parser","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}