CVE-2026-107697Medium· 4.3▾ SunlitFFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whos…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.
ffmpeg < 8.1.3Upgrade past the affected range:
ffmpeg 8.1.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107695Medium· 6.5FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists
CVE-2026-107696Medium· 6.5FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit
CVE-2026-107698Medium· 5.4FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL
CVE-2026-75147High· 7.1FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c
CVE-2026-75144High· 7.8FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer
CVE-2026-75145Medium· 5.8FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer