CVE-2026-107697
FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()
FFmpeg FFmpegLibraries & packages
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 8.1.3FFmpegCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.
Text from CVE List
Affected versions 1
- FFmpegaffected: all versions before 8.1.3CVE List
References 6
- github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323Fixvia CVE List
- github.com/FFmpeg/FFmpeg/commit/01044d04536eFixvia CVE List
- github.com/FFmpeg/FFmpeg/commit/191715f0232cFixvia CVE List
- vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlistAdvisoryvia CVE List
- github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834Referencevia CVE List
- github.com/FFmpeg/FFmpegReferencevia CVE List