CVE-2026-107697

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-107697
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/FFmpeg/FFmpeg Product
https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834 Product
https://github.com/FFmpeg/FFmpeg/commit/01044d04536e Patch
https://github.com/FFmpeg/FFmpeg/commit/191715f0232c Patch
https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323 Patch
https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
History

15 Oct 2026, 00:01

Type Values Removed Values Added
First Time Ffmpeg
Ffmpeg ffmpeg
CPE cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
References () https://github.com/FFmpeg/FFmpeg - () https://github.com/FFmpeg/FFmpeg - Product
References () https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834 - () https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834 - Product
References () https://github.com/FFmpeg/FFmpeg/commit/01044d04536e - () https://github.com/FFmpeg/FFmpeg/commit/01044d04536e - Patch
References () https://github.com/FFmpeg/FFmpeg/commit/191715f0232c - () https://github.com/FFmpeg/FFmpeg/commit/191715f0232c - Patch
References () https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323 - () https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323 - Patch
References () https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist - () https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist - Patch, Third Party Advisory

08 Oct 2026, 18:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-08 18:17

Updated : 2026-10-15 00:01

NVD link : CVE-2026-107697

Mitre link : CVE-2026-107697

CVE.ORG link : CVE-2026-107697

JSON object : View

Products Affected

ffmpeg

  • ffmpeg
CWE
CWE-693

Protection Mechanism Failure