CVE-2026-105273
7.5HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-835
Impact
Remote, unauthenticated attackers can cause a persistent denial of service by sending a malformed MP4 file. Processing the file hangs the parser in an infinite loop and exhausts system resources.
Root cause
MP4Parser fails to properly validate MP4 box sizes, causing it to loop endlessly on identical input without making forward progress.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Check CISA advisory icsma-26-288-02 for specific patch releases and affected products. If patching immediately is not possible, restrict untrusted MP4 uploads or isolate the parsing service from external inputs.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.