CVE-2026-90816
Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in FFmpeg via HLS Duration Parser

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90816

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ffmpeg ffmpeg to 8.1 (exc)
ffmpeg ffmpeg 8.1
ffmpeg ffmpeg 9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects FFmpeg 8.0.x in the Duration Parser component. It allows a remote attacker to cause a denial of service by manipulating the duration or target_duration argument in the parse_playlist function of libavformat/hlsproto.c. Upgrading to versions 8.1 or 9.0 fixes the issue.

Detection Guidance

Detection involves checking for vulnerable FFmpeg versions (8.0.x) and monitoring for HLS playlist parsing issues. Inspect FFmpeg version with 'ffmpeg -version'. Monitor for crashes or hangs during HLS stream processing.

Impact Analysis

The vulnerability can lead to denial of service, causing the affected system to become unresponsive or crash. This could disrupt services relying on FFmpeg for media processing, such as streaming or video handling.

Compliance Impact

This vulnerability causes a denial of service via remote manipulation of duration parameters in FFmpeg. While it does not directly expose or leak data, prolonged service disruption could impact systems handling sensitive data, potentially affecting compliance with GDPR (availability principle) or HIPAA (operational integrity). However, no direct evidence links this issue to specific compliance violations.

Mitigation Strategies

Upgrade FFmpeg to version 8.1 or 9.0 immediately. Apply the patch 64fafd63f0b4 if available. Disable HLS processing if not required. Monitor for exploitation attempts targeting HLS streams.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90816. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart