Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107697FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()

Medium 4.3

In plain English

A medium-severity security flaw in FFmpeg from FFmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 75.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ffmpeg	no fix listed	DEBIAN-CVE-2026-107697
Debian:13	ffmpeg	no fix listed	DEBIAN-CVE-2026-107697
Debian:14	ffmpeg	7:9.0.2-1	DEBIAN-CVE-2026-107697
Ubuntu:26.10	ffmpeg	no fix listed	UBUNTU-CVE-2026-107697

Affected products (as reported)

Vendor	Product	Versions
FFmpeg	FFmpeg	0 – before 8.1.3

Weakness: CWE-693 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

Patch Commit patch
Backport to release/9.0 patch
Backport to release/8.1 patch
https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834 technical-description
https://github.com/FFmpeg/FFmpeg product
VulnCheck Advisory: FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist() third-party-advisory