CVE-2026-107695: FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parseplaylist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hlsreadheader(), causing unbounded CPU and I/O consumption.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to persuade a victim to open a crafted self-referencing HLS playlist. No authentication or prior privileges are required, but user interaction is required.
Who is exposed to denial of service?
Systems using affected FFmpeg versions to process HLS playlists are exposed when they open attacker-controlled or untrusted playlist content. The crafted playlist can drive unbounded CPU and I/O consumption.
How can I determine whether a system is affected?
Check the FFmpeg version in use. Versions before 8.1.3 are affected according to the available information, particularly where the HLS demuxer processes playlists.
What can be done before upgrading?
Avoid opening HLS playlists from untrusted sources and restrict workflows that allow users or remote parties to supply playlist URLs or files. This reduces the opportunity to trigger the self-referencing playlist condition.