CVE-2026-120458: medium-severity vulnerability in Ultra Video Group Kvazaar
Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.8epss 0.2%
Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
Ultra Video Group · Kvazaarpublic PoCs found — 1
cve_referencehackmd.io/@haindpwn/cve-2026-120458-kvazaar-y4m-header-missing-newline-infinite-loopunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://github.com/ultravideo/kvazaar/blob/v2.3.2/src/encmain.c#L339-L357https://github.com/ultravideo/kvazaar/commit/8a2f109be283e87008c679d635966cc034da39c6https://github.com/ultravideo/kvazaar/issues/452https://github.com/ultravideo/kvazaar/releases/tag/v2.3.2https://hackmd.io/@haindpwn/cve-2026-120458-kvazaar-y4m-header-missing-newline-infinite-loophttps://hackmd.io/@haindpwn/kvazaar-y4m-header-missing-newline-infinite-loophttps://www.vulncheck.com/advisories/kvazaar-through-2.3.2-infinite-loop-dos-via-y4m-header-parser