CVE-2026-107695
Ffmpeg: denial of service
- Risk score
- 52/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants …
- Affected
- Ffmpeg before 8.1.3
- Fix
- Upgrade Ffmpeg to 8.1.3 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
Ffmpeg: Yellow, plan it in. FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants …
The flaws
- CVE-2026-107695: Denial of service (CVSS 6.5 · EPSS 0%)
- CVE-2026-107696: FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in… (CVSS 6.5 · EPSS 0%)
The fix
Upgrade Ffmpeg: 8.1.3 or later on your release line
Who is exposed: Ffmpeg before 8.1.3
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-835 (CWE-835). 52 other warnings in 30 days
- Same product: Earlier Ffmpeg warnings. 7 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
- Public exploit or proof of concept referenced
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618
- https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866
- https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a
- https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78
- https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5
- https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist
Original description
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.
Last activity 8 Oct 2026. Patch Forecast updates every hour.