CVE-2026-107697: FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowedextensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parseplaylist() open resources the HLS security policy should block.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpegto a version that resolves this vulnerability.Fixed in 8.1.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using FFmpeg's HLS demuxer before version 8.1.3 are exposed when they open an attacker-supplied or otherwise untrusted master HLS playlist. The issue is triggered through child playlists referenced by that master playlist.
What must an attacker provide to exploit it?
An attacker needs to supply a crafted master playlist containing child-playlist references that use protocols or local-file types disallowed by the configured HLS security policy. Exploitation requires a user or application to open that playlist.
What is the impact of bypassing these restrictions?
The HLS demuxer can open resources that its protocol and allowed_extensions restrictions were intended to block, including resources using disallowed protocols or non-multimedia local files. The provided data rates the issue medium severity with low confidentiality impact and no integrity or availability impact.
How can this be remediated?
Update FFmpeg to version 8.1.3 or later. If updating is not immediately possible, avoid opening untrusted master HLS playlists, since the bypass occurs when processing their child playlist references.