CVE-2026-107696
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in…
- Risk score
- 50/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 8 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a C…
- Affected
- Ffmpeg
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Ffmpeg: Yellow, plan it in. FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants …
The flaws
- CVE-2026-107696: FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in… (CVSS 6.5 · EPSS 0%)
- CVE-2026-107695: Denial of service (CVSS 6.5 · EPSS 0%)
The fix
Upgrade Ffmpeg: 8.1.3 or later on your release line
Who is exposed: Ffmpeg before 8.1.3
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-835 (CWE-835). 52 other warnings in 30 days
- Same product: Earlier Ffmpeg warnings. 7 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
- Public exploit or proof of concept referenced
References
- https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902
- https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013
- https://github.com/FFmpeg/FFmpeg
- https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225
- https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c
Original description
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.
Last activity 8 Oct 2026. Patch Forecast updates every hour.