Kvazaar versions up to 2.3.2 contain an infinite loop in the read_header() function of src/encmain.c. When a .y4m file that is missing a terminating newline is processed, the encoder performs unchecked end‑of‑file reads that never terminate, causing the process to hang indefinitely and consume 100% of a CPU core. This results in a denial of service, rendering the encoder unresponsive and potentially exhausting system resources for other tasks.

The affected product is Kvazaar from Ultra Video Group. All releases through and including version 2.3.2 are impacted. Users of any 2.3.x build that has not been updated to a newer release are susceptible.

The vulnerability has a CVSS score of 6.8 and no EPSS score is publicly available, indicating no confirmed exploit probability yet. It is not listed in CISA KEV. The likely attack vector is local or via an untrusted file input; an attacker must supply a crafted Y4M file to the command‑line encoder. Absence of any network component in the description suggests the risk is limited to environments where the encoder runs under the attacker's access or with untrusted input files. The impact is a hung process consuming CPU resources, but it does not compromise confidentiality or integrity.