CVE-2026-107697 — FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child pl…
Published: 2026-10-08 · CVSS: 5.3 · CVSS 4.0
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7