FFmpeg CVE-2026-90816

Exploitation requires: (1) the target runs FFmpeg version 8.0.x specifically - neither earlier stable branches nor 8.1/9.0 are affected; (2) the application invokes the HLS protocol handler to process a .m3u8 playlist sourced from an attacker-controlled or attacker-influenced location; (3) passive user interaction (UI:P) - a user must open the stream URL, or an automated service must fetch and parse the playlist without a trusted-source allowlist. Impact is strictly limited to denial of service of the FFmpeg process; code execution, data exfiltration, and integrity compromise are not possible per the CVSS impact metrics. Applications processing only internally generated or cryptographically authenticated HLS content are not at risk.

The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P reflects low attack complexity but requires passive user interaction, with impact limited to low availability on the vulnerable system only. No confidentiality or integrity impact is assessed. EPSS data is absent from the provided intelligence, and this CVE is not listed in CISA KEV with no known public proof-of-concept - collectively these signals support a low near-term exploitation probability. The UI:P constraint prevents fully automated mass exploitation, as a user or automated pipeline must actively open or ingest the malicious stream. Even a mid-sized media-processing operation in sanok running FFmpeg 8.0.x for live stream ingest should treat this as a routine patch rather than an emergency response, given the bounded DoS-only impact and the readily available upstream fix. The CVSS vector is consistent with the description; no conflicts are detected.

An attacker hosts a malicious HLS playlist file containing a crafted #EXTINF or #EXT-X-TARGETDURATION field with a boundary-violating value, then entices a user or automated media-ingest service running FFmpeg 8.0.x to fetch and process the stream URL. The vulnerable parse_playlist() function fails to properly release resources when handling the malformed duration, causing the FFmpeg process to hang or crash and resulting in denial of service. No public proof-of-concept code is known at time of analysis.