CVE-2023-6604: Ffmpeg: hls xbin demuxer dos amplification in ffmpeg

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-01-06 · updated 2026-06-17
Weakness: CWE-99

Description

A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation.

Affected products

FFmpeg: from 2.0 through 6.0

References

https://bugzilla.redhat.com/show_bug.cgi?id=2334337
https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html

Get alerted when CVE-2023-6604 or the next vulnerability affects your stack