The flaw in FFmpeg’s RTP/ASF demuxer causes an infinite loop when the library processes a crafted RTP/ASF stream that contains a chunksize smaller than the 24‑byte minimum ASF object header. The loop never advances, exhausting CPU resources and denying service to legitimate users. The vulnerability results in a denial‑of‑service condition and no remote code execution or compromise of confidentiality or integrity.

FFmpeg versions 0.6.3 through 8.1.2 on any platform that uses the libavformat library are affected. Attackers can trigger the issue from a remote network location by sending a malicious RTP/ASF stream to a host running one of these versions.

The CVSS score of 8.7 classifies the issue as high severity. The EPSS score indicates a low but non‑zero exploitation probability of less than 1%, and it is not listed in the CISA KEV catalog. The exploit requires the ability to transmit a crafted RTP/ASF packet, which is typically possible from any remote host that can reach the vulnerable demuxer. Once the packet is processed, an infinite loop on the CPU leads to a DoS.