CVE-2017-14058 FFmpeg HLS Infinite Loop DoS via Self-Referencing Variant Playlist

FFmpeg — HLS Infinite Loop DoS via Self-Referencing Variant Playlist Vulnerability Overview Vulnerability Name: FFmpeg — HLS Infinite Loop DoS via Self-Referencing Variant Playlist Vulnerability ID: CVE-2017-14058 Vulnerability Type: Denial of Service (DoS) Affected Versions: FFmpeg 8.1.1.3 (Kali / Debian package), FFmpeg release/8.1 (git source), FFmpeg release/7.1 (git source) Description: A 73-byte self-referencing HLS master playlist causes FFmpeg to enter an infinite I/O loop, consuming 100% of a CPU core until the process is forcibly terminated. Root Cause: In the function, the loop condition is incremented by the function within the loop body, causing the condition to always remain true and preventing loop exit. Impact: Any service calling FFmpeg via user-controlled URLs or uploaded files is potentially exploitable remotely. Scope Affected Versions: - FFmpeg 8.1.1.3 (Kali / Debian package) - FFmpeg release/8.1 (git source) - FFmpeg release/7.1 (git source) - All versions between 3.3.4 and 8.1.1 are likely also affected Remediation Fix Status: Unpatched Recommendations: No official fix is available. It is recommended that users monitor process lifecycles or CPU usage and manually terminate processes when necessary. Proof of Concept (POC) Code Evidence Environment: - OS: Kali Linux x86_64 (Debian-based) - FFmpeg: 8.1.1.3 — /usr/bin/ffmpeg (official Kali package) - gcc 15 (Debian 15.2.0-17) strace — I/O loop confirmed at syscall level: Process state: Measured metrics: Log pattern analysis: Root Cause Analysis Execution Path: With , reads and calls -> -> . After this, and . Since the file has no lines, . Therefore, the guard at line 2174 evaluates to true: Vulnerable Loop Execution (Lines 2175-2183): Each entry in is . On each iteration, re-opens the file on disk, reads , and calls -> , which executes: is incremented within the loop body. The condition re-evaluates on each iteration. Since it grows at the same rate as , the condition always remains true. The loop never exits. Missing Guard in : (line 351) calls unconditionally, without checking if the target URL is already registered: There is no set access, no URL comparison, and no depth limit. Why CVE-2017-14058 Fix Does Not Protect Here: The fix for CVE-2017-14058 introduced a counter in (line 1574): is called from (line 2529), which is invoked only after returns successfully. Since never returns, is never called, and is never checked. Comparison with CVE-2017-14058 CVSS Scoring Explanation CVE-2017-14058 was rated 6.5 Medium because it requires UI:R (User Interaction), as its primary exploitation scenario involves a user opening a malicious file in a media player. This vulnerability is rated 7.5 High because it requires UI:N (User Interaction Required), targeting server-side processing pipelines — such as video transcoding services, upload handlers, and ingest servers — where FFmpeg is invoked automatically on user-provided content without any manual interaction from the victim. The attacker uploads or links a file; the server processes it autonomously. No clicking, opening, or user action is required. Impact Denial of Service: Any application invoking FFmpeg with user-controlled media input is vulnerable: - Video transcoding or processing platforms - Media thumbnail and preview generators - Streaming ingest servers accepting HLS input - Any web service calling A single 73-byte file permanently consumes one CPU core. Multiple concurrent uploads can exhaust all workers. Lack of Automatic Detection: FFmpeg generates no error messages and returns no non-zero exit codes. Without monitoring process lifecycles or CPU usage, automated monitoring systems will not detect the hang. Disk I/O Amplification: When is enabled (common in production logging): - 141 MB of log output is generated within minutes - Log files grow unbounded until the disk is full

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2017-14058 FFmpeg HLS Infinite Loop DoS via Self-Referencing Variant Playlist

More from this source