CVE-2026-107695

6.5 MEDIUMpublic exploit available

Published 2026-10-08 · Updated 2026-10-14

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses

CWE-835

Vendors

ffmpeg

Products

ffmpeg

Public exploit & PoC references

https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0[Exploit, Mitigation, Third Party Advisory]
https://github.com/FFmpeg/FFmpeg[Product]
https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866[Product]
https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a[Patch]
https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78[Patch]
https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5[Patch]

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.