CVE-2026-107695
FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
FFmpeg FFmpegLibraries & packages
CVSS
7.1HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 14 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.46%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 8.1.3FFmpegCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.
Text from CVE List
Affected versions 1
- FFmpegaffected: all versions before 8.1.3CVE List
References 8
- github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5Fixvia CVE List
- github.com/FFmpeg/FFmpeg/commit/0e6eef35517aFixvia CVE List
- github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78Fixvia CVE List
- code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618Fixvia CVE List
- vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlistAdvisoryvia CVE List
- gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0Exploitvia CVE List
- github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866Referencevia CVE List
- github.com/FFmpeg/FFmpegReferencevia CVE List