CVE-2026-107695
HIGH
7,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: passive
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Description
AI Translation Available
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0045
Percentile
0,4th
Updated
EPSS Score Trend (Last 3 Days)
835
Loop with Unreachable Exit Condition ('Infinite Loop')
IncompleteCommon Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Dos: Amplification
Applicable Platforms
All platforms may be affected
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618
https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0
https://github.com/FFmpeg/FFmpeg
https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866
https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a
https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78
https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5
https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-l…