CVE-2026-120458 Details
Description
Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.
A denial-of-service vulnerability has been identified in the Kvazaar HEVC/H.265 encoder, specifically in versions through 2.3.2. The issue arises in the command-line encoder's Y4M header parser, where a crafted Y4M file lacking a terminating newline can cause an infinite loop. This loop occurs because the parser, which reads the header byte by byte, fails to check for the end-of-file condition properly. As a result, the process hangs indefinitely, consuming a full CPU core.
Users can upgrade to Kvazaar version 2.3.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/cve-2026-120458-kvazaar-y4m-header-missing-newline-infinite-loop | CISA-ADP | |
| https://github.com/ultravideo/kvazaar/blob/v2.3.2/src/encmain.c#L339-L357 | [email protected] | Source CodeVendor |
| https://github.com/ultravideo/kvazaar/commit/8a2f109be283e87008c679d635966cc034da39c6 | [email protected] | Source CodeVendor |
| https://github.com/ultravideo/kvazaar/issues/452 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/ultravideo/kvazaar/releases/tag/v2.3.2 | [email protected] | Release NotesVendor |
| https://hackmd.io/@haindpwn/kvazaar-y4m-header-missing-newline-infinite-loop | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/kvazaar-through-2.3.2-infinite-loop-dos-via-y4m-header-parser | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kvazaar | <= 2.3.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |