CVE-2026-107695

MEDIUM 6.5

FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.

CWE	CWE-835
Vendor	ffmpeg
Product	ffmpeg
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

FFmpeg / FFmpeg

0 < 8.1.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5 github.com: https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a github.com: https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78 code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618 github.com: https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866 gist.github.com: https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist

Credits

BapToutatis