CVE-2026-90816: FFmpeg HLS Protocol DOS Vulnerability

CVE-2026-90816 Overview

CVE-2026-90816 is a denial of service vulnerability affecting FFmpeg 8.0.x. The flaw resides in the parse_playlist function within libavformat/hlsproto.c, part of the HLS (HTTP Live Streaming) protocol Duration Parser component. Attackers can manipulate the duration or target_duration argument in a crafted HLS playlist to trigger a denial of service condition. The vulnerability is remotely exploitable but requires user interaction, such as opening a malicious playlist. The FFmpeg project addressed the issue in commit 64fafd63f0b4, released in versions 8.1 and 9.0. The weakness is categorized under [CWE-404] (Improper Resource Shutdown or Release).

Critical Impact
Remote attackers can cause FFmpeg processes to enter a denial of service state by delivering a malicious HLS playlist with manipulated duration values.

Affected Products

FFmpeg 8.0.x (all point releases prior to 8.1)
FFmpeg HLS protocol handler (libavformat/hlsproto.c)
Downstream applications and media pipelines linking vulnerable FFmpeg builds

Discovery Timeline

2026-09-14 - CVE-2026-90816 published to NVD
2026-09-15 - Last updated in NVD database
Patch - FFmpeg commit 64fafd63f0b4 merged, shipped in versions 8.1 and 9.0

Technical Details for CVE-2026-90816

Vulnerability Analysis

The vulnerability lives in the parse_playlist function of libavformat/hlsproto.c. This function parses HLS playlist manifests and interprets segment duration metadata, including the #EXT-X-TARGETDURATION and #EXTINF duration fields. Improper handling of these values during parsing leads to a resource management failure classified as [CWE-404]. When an attacker supplies crafted duration values, FFmpeg fails to release or bound resources correctly, degrading the process to an unresponsive state. The attack requires user interaction, meaning a victim must open or stream a malicious HLS URL or file through an FFmpeg-based tool or library.

Root Cause

The root cause is improper validation and resource handling of the duration and target_duration arguments during HLS playlist parsing. The parser does not adequately constrain or reject unexpected values, so malformed input drives the parser into a state where resources are not properly shut down or bounded.

Attack Vector

Exploitation occurs over the network. An attacker hosts a malicious .m3u8 HLS playlist containing manipulated duration fields. When a user opens the playlist via an application that uses vulnerable FFmpeg libraries, the parser consumes resources abnormally and the process becomes unavailable. No authentication is required, but user interaction is necessary to trigger the parse. See the FFmpeg Commit Reference and the FFmpeg Issue Tracker Entry for the upstream discussion and fix.

No verified public exploit code is available. See the referenced commit and issue tracker for technical details of the fix.

Detection Methods for CVE-2026-90816

Indicators of Compromise

FFmpeg or FFmpeg-linked processes consuming abnormal CPU or memory while parsing .m3u8 playlists.
Repeated crashes, hangs, or restarts of media services that ingest untrusted HLS streams.
Inbound HLS playlist requests to endpoints running FFmpeg 8.0.x from unexpected sources.

Detection Strategies

Inventory systems using FFmpeg 8.0.x libraries via software composition analysis tooling.
Inspect HLS playlists at the proxy or gateway layer for anomalous #EXT-X-TARGETDURATION or #EXTINF values outside expected ranges.
Correlate media service crash logs with recent HLS parsing activity to identify exploitation attempts.

Monitoring Recommendations

Monitor process health of media transcoders and streaming services for unexpected termination or resource spikes.
Log all outbound requests initiated by FFmpeg to detect fetches of attacker-controlled playlists.
Alert on repeated parsing failures in libavformat when handling HLS content.

How to Mitigate CVE-2026-90816

Immediate Actions Required

Upgrade FFmpeg to version 8.1 or 9.0, which include the patch identified as commit 64fafd63f0b4.
Rebuild and redeploy applications that statically link or bundle FFmpeg libraries.
Restrict FFmpeg-based services from processing HLS content sourced from untrusted origins until patched.

Patch Information

The upstream fix is committed as 64fafd63f0b4 and is included in FFmpeg 8.1 and 9.0. Review the FFmpeg Commit Reference and the VulDB CVE-2026-90816 entry for full remediation guidance. Downstream distributions should track backports through their respective security advisories.

Workarounds

Disable the HLS protocol handler in FFmpeg builds where HLS ingestion is not required.
Validate and sanitize HLS playlists at an upstream proxy, rejecting manifests with out-of-range duration values.
Sandbox FFmpeg processing with resource limits (for example, cgroups CPU and memory caps) to contain denial of service impact.

bash

# Example: constrain FFmpeg protocol whitelist to exclude HLS when not needed
ffmpeg -protocol_whitelist "file,http,https,tcp,tls" -i input.mp4 output.mp4