CVE-2026-107695: FFmpeg HLS Demuxer DOS Vulnerability

CVE-2026-107695 Overview

CVE-2026-107695 is an infinite loop vulnerability [CWE-835] in the HTTP Live Streaming (HLS) demuxer of FFmpeg versions before 8.1.3. The parse_playlist() function improperly accepts Master Playlist tags inside Media Playlists. A remote attacker can craft a self-referencing HLS playlist that causes hls_read_header() to endlessly add variants, exhausting CPU and I/O resources. Exploitation requires a victim to open the malicious playlist with a vulnerable FFmpeg build, resulting in denial of service for the affected process or host.

Critical Impact
A single crafted .m3u8 playlist can trigger unbounded resource consumption in any application or service that embeds FFmpeg for media processing, degrading availability of transcoding pipelines, streaming servers, and media workflows.

Affected Products

FFmpeg versions prior to 8.1.3
Applications and services bundling vulnerable FFmpeg builds (media servers, transcoders, thumbnail generators)
Downstream distributions and container images shipping FFmpeg < 8.1.3

Discovery Timeline

2026-10-08 - CVE-2026-107695 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107695

Vulnerability Analysis

The flaw resides in libavformat/hls.c, specifically in parse_playlist(). The HLS specification separates two playlist types: Master Playlists, which enumerate alternate variant streams via #EXT-X-STREAM-INF:, and Media Playlists, which list media segments. The parser did not enforce this separation. When a Media Playlist contained Master Playlist tags, the demuxer treated them as new variants and queued them for retrieval. An attacker can host a Media Playlist that declares itself as a variant stream, so each parse iteration enqueues the same URL again. The result is an unbounded loop in hls_read_header() that continuously fetches and parses the same resource, exhausting CPU cycles and network or disk I/O.

Root Cause

The root cause is missing input validation in the playlist parser. Any application using the HLS demuxer accepts user-controlled playlist content without rejecting cross-type tag usage, violating the HLS protocol contract and enabling self-referential loops.

Attack Vector

Exploitation is remote and requires user interaction: a victim must open or process the crafted .m3u8 URL or file. The vulnerability affects confidentiality and integrity minimally but has a direct availability impact on the host process.

// Patch excerpt from libavformat/hls.c - parse_playlist()
    while (!avio_feof(in)) {
        ff_get_chomp_line(in, line, sizeof(line));
        if (av_strstart(line, "#EXT-X-STREAM-INF:", &ptr)) {
+           if (pls) {
+               av_log(c->ctx, AV_LOG_ERROR,
+                      "Master Playlist tag found in a Media Playlist\n");
+               ret = AVERROR_INVALIDDATA;
+               goto fail;
+           }
            is_variant = 1;
            memset(&variant_info, 0, sizeof(variant_info));
            ff_parse_key_value(ptr, handle_variant_args, &variant_info);

Source: FFmpeg commit c364ab1. The patch rejects any #EXT-X-STREAM-INF: tag encountered while a Media Playlist context (pls) is active, returning AVERROR_INVALIDDATA instead of adding another variant.

Detection Methods for CVE-2026-107695

Indicators of Compromise

Sustained 100% CPU utilization in ffmpeg, ffprobe, or any process linking libavformat
Repeated outbound HTTP(S) requests from a media worker to the same .m3u8 URL in a tight loop
FFmpeg log entries referencing repeated variant additions or self-referencing playlist URLs
Media processing jobs that never complete and must be killed by watchdogs or timeouts

Detection Strategies

Inventory all deployed FFmpeg binaries and shared libraries, flagging versions prior to 8.1.3
Inspect inbound .m3u8 files for #EXT-X-STREAM-INF: tags appearing alongside media segment tags such as #EXTINF: and #EXT-X-TARGETDURATION
Correlate process CPU time with network connection counts to detect runaway demuxer loops
Add egress logging on media workers to spot repeated fetches of identical playlist URLs

Monitoring Recommendations

Enforce execution time and CPU budget ceilings on FFmpeg processes handling untrusted input
Ship FFmpeg stderr to a central log pipeline and alert on the new Master Playlist tag found in a Media Playlist string after patching
Monitor queue depth and job latency in transcoding services to catch stalled workers early

How to Mitigate CVE-2026-107695

Immediate Actions Required

Upgrade FFmpeg to version 8.1.3 or later across all hosts, containers, and bundled dependencies
Rebuild and redeploy any downstream application that statically links libavformat from an older FFmpeg release
Apply process-level resource limits (ulimit, cgroups, container CPU quotas) to constrain impact until patching completes

Patch Information

The fix is implemented in libavformat/hls.c and landed via multiple commits across FFmpeg branches: 0e6eef3, a4ddaba, and c364ab1. See FFmpeg Pull Request #23618 and the VulnCheck advisory for full details.

Workarounds

Disable the HLS demuxer when it is not required by invoking FFmpeg with an explicit allowlist of formats
Reject or sanitize user-supplied .m3u8 input at the application boundary, blocking mixed Master and Media Playlist tags
Isolate media processing in sandboxed workers with strict CPU, memory, and wall-clock timeouts
Restrict FFmpeg protocol handlers to local files only, blocking remote http, https, and hls fetches

bash

# Example: restrict FFmpeg protocols and formats when handling untrusted playlists
ffmpeg -protocol_whitelist "file" \
       -f_strict experimental \
       -allowed_extensions ALL \
       -i input.m3u8 -t 30 output.mp4

# Enforce CPU and wall-clock ceilings on media workers (Linux)
systemd-run --scope -p CPUQuota=50% -p RuntimeMaxSec=60s \
    ffmpeg -i "$UNTRUSTED_URL" -f null -