CVE-2026-107697

MEDIUM 4.3

FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.

CWE	CWE-693
Vendor	ffmpeg
Product	ffmpeg
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new medium vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

FFmpeg / FFmpeg

0 < 8.1.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323 github.com: https://github.com/FFmpeg/FFmpeg/commit/01044d04536e github.com: https://github.com/FFmpeg/FFmpeg/commit/191715f0232c github.com: https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834 github.com: https://github.com/FFmpeg/FFmpeg vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist

Credits

BapToutatis