EUVD-2026-95123
GHSA-wrmh-p2hh-7cf6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remotely-supplied playlist (AV:N) triggers trivially (AC:L) without auth (PR:N) but a victim must open the file (UI:R); impact is availability-only DoS (A:H, C/I:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.
AnalysisAI
Infinite loop in FFmpeg's HLS demuxer (libavformat/hls.c) lets remote attackers pin CPU and I/O indefinitely on any host that feeds a crafted playlist to FFmpeg before version 8.1.3. A malicious Media Playlist that embeds Master Playlist tags causes parse_playlist()/hls_read_header() to keep registering self-referencing variants that never terminate. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the FFmpeg HLS demuxer to parse an attacker-supplied playlist: the crafted Media Playlist must contain Master Playlist tags producing a self-referencing variant loop that parse_playlist()/hls_read_header() processes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a denial-of-service vulnerability with a moderate real-world priority, not a critical emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: FFmpeg 8.1.3 - upgrade to 8.1.3 or later, or rebuild libavformat from upstream commits c364ab176f722bdabc886845e770c9eacbc1e3e5 / 0e6eef35517a / a4ddaba8bb78 (PR https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618) if distribution packaging lags; advisory details are at https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every FFmpeg deployment across build pipelines, transcoding farms, media gateways, and developer workstations, and treat any instance below 8.1.3 as exposed; where immediate upgrade is not possible, restrict ingestion of untrusted HLS playlists and add resource limits (CPU quotas, timeouts, process supervision) around FFmpeg invocations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today