CVE-2026-107695 in FFmpeg
Summary
by MITRE • 10/08/2026
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in FFmpeg versions prior to 8.1.3 represents a critical flaw within the HTTP Live Streaming demuxer, specifically affecting how Master Playlists and Media Playlists are parsed. This issue stems from an insufficient validation of playlist structure during the initialization phase of stream processing. The core technical failure lies in the parse_playlist function, which incorrectly accepts Master Playlist tags when they appear inside what should be strictly defined as a Media Playlist. In standard HLS architecture, these two types of playlists serve distinct purposes and have rigid structural requirements; mixing them violates protocol specifications but is not adequately rejected by the parser logic before processing begins.
The operational impact of this flaw manifests as an infinite loop that leads to severe resource exhaustion on the affected system. When a remote attacker crafts a malicious playlist file containing self-referencing entries, they can exploit the hls_read_header function to trigger unbounded iteration. As FFmpeg attempts to parse these malformed structures, it continuously adds variants without ever reaching a termination condition. This results in continuous CPU consumption and excessive I/O operations as the application spins indefinitely trying to resolve nested or circular references within the playlist data structure.
From an attack perspective, this vulnerability enables remote denial of service attacks against any user or system that processes the crafted HLS content using vulnerable versions of FFmpeg. An attacker can distribute a malicious link or file containing the self-referencing playlist, and upon opening by a victim application utilizing the compromised library, the resulting infinite loop will degrade system performance to the point of unresponsiveness. This type of resource exhaustion attack is particularly dangerous in server-side environments where such processing might occur automatically as part of media ingestion pipelines, potentially leading to service outages for multiple users sharing the same infrastructure resources.
This vulnerability aligns with CWE-835, which describes loops that do not terminate correctly due to missing or incorrect termination conditions. Furthermore, it relates to CWE-20 regarding improper input validation, as the parser fails to enforce strict adherence to HLS specification constraints regarding playlist hierarchy and tag placement. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1496, Resource Hijacking, where an attacker consumes computational resources to disrupt availability rather than compromising confidentiality or integrity directly.
Mitigation strategies primarily involve upgrading FFmpeg to version 8.1.3 or later, which includes patches for the HLS demuxer logic to properly reject invalid playlist structures before processing begins. For environments that cannot immediately upgrade, implementing input validation at the application layer is recommended. This involves sanitizing incoming HLS playlists to ensure they strictly conform to RFC standards and do not contain nested Master Playlist tags within Media Playlists or self-referencing variants that could trigger infinite loops during parsing. Additionally, deploying resource limits such as CPU time quotas for media processing services can help mitigate the impact of such denial-of-service attempts by terminating processes that exceed expected execution thresholds.