CVE-2026-107695

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-08

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-08

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107695

EUVD

EUVD-2026-95123

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	to 8.1.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This is an infinite loop vulnerability in FFmpeg's HLS demuxer. It occurs when a crafted HLS playlist contains Master Playlist tags inside a Media Playlist. The parse_playlist function incorrectly processes these tags, causing hls_read_header to repeatedly add variants without exiting, leading to unbounded CPU and I/O consumption.

Detection Guidance

Monitor for processes consuming excessive CPU or I/O due to infinite loops in FFmpeg HLS parsing. Check logs for repeated playlist reloading or errors in avformat/hls.c. Use network traffic analysis to detect repeated requests to the same HLS playlist file.

Impact Analysis

This vulnerability can cause denial of service by consuming 100% CPU and I/O indefinitely. It affects server-side applications processing user-uploaded HLS content like video transcoding services or streaming servers. Exploitation requires no user interaction and can be triggered remotely.

Compliance Impact

This vulnerability primarily causes denial-of-service via infinite loops, leading to excessive CPU and I/O consumption. It does not directly affect data confidentiality or integrity but may impact system availability. Compliance with GDPR or HIPAA could be indirectly affected if service disruption leads to unauthorized access or data processing delays, though no direct data exposure is described.

Mitigation Strategies

Upgrade FFmpeg to version 8.1.3 or later to apply the official patch.
Block or sanitize untrusted HLS playlist files before processing them with FFmpeg.
Implement rate limiting or timeout mechanisms for playlist parsing operations.

Hi! I’m here to help you understand CVE-2026-107695. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70