TI-2026-83850 CVE-2026-120458 · GHSA-chw9-qpvj-3r3mInfinite loop in Kvazaar Y4M header parser allows denial of servicePriority MEDIUM 63Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header.CVSS 4.0MEDIUM 6.8· Local · No auth · User interaction · EPSS 0.00165 · Published 2026-11-02 · No fix listed CWE-835