Vulnerability · Published Sep 14, 2026 · Assigned by VulDB

CVE-2026-90816FFmpeg Duration hlsproto.c parse_playlist denial of service

Medium 4.3

In plain English

A medium-severity security flaw in FFmpeg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.6%top 52.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ffmpeg	no fix listed	DEBIAN-CVE-2026-90816
Debian:13	ffmpeg	no fix listed	DEBIAN-CVE-2026-90816
Debian:14	ffmpeg	7:8.1-1	DEBIAN-CVE-2026-90816
Ubuntu:26.10	ffmpeg	no fix listed	UBUNTU-CVE-2026-90816

Affected products (as reported)

Vendor	Product	Versions
n/a	FFmpeg	8.0.*

Weakness: CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

References

VDB-403318 | FFmpeg Duration hlsproto.c parse_playlist denial of service vdb-entry, technical-description
VDB-403318 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-90816 | CVE Analysis and Report third-party-advisory
Submit #922626 | FFmpeg FFmpeg ≤ 8.0.x Denial of Service third-party-advisory
https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492 issue-tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4 patch
https://ffmpeg.org/ product