FFmpeg XBIN Demuxer Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in FFmpeg versions 2.0 (at least) through 6.0 (latest). This issue arises in the HLS (HTTP Live Streaming) XBIN demuxer, where the absence of proper input format validation allows arbitrary data to be processed as XBIN-formatted. This exploitation leads to a significant increase in CPU usage during transcoding and creates excessively large output files, causing degraded performance. The vulnerability could be triggered by crafting an HLS playlist that bypasses file extension checks, directing FFmpeg to demux non-XBIN data as XBIN, which is then amplified into a larger file.

Impact

Exploitation of this vulnerability causes unexpected additional CPU load and storage consumption, potentially leading to degraded performance or a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by creating an HLS playlist that includes base64-encoded data URIs. By appending a valid media file extension to the base64 data, the HLS demuxer can be tricked into processing the data as XBIN. This can be done by using FFmpeg to transcode the crafted playlist, which will result in an output file that is disproportionately larger than the input, indicating successful exploitation.

Remediation

To address this vulnerability, the XBIN demuxer should only be activated if the input file extension matches a known XBIN extension, such as .XB.