CVE-2026-107697 FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()
Attackers can bypass HLS security restrictions to access disallowed protocols or local files via crafted playlists in FFmpeg.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-107697?
CVE-2026-107697 is a medium-severity vulnerability in Ffmpeg Ffmpeg, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.
Weakness: CWE-693
Which versions are affected by CVE-2026-107697?
It affects 1 product.
Products include Ffmpeg Ffmpeg.
How do I fix CVE-2026-107697?
Upgrade to a fixed version.
Is CVE-2026-107697 being exploited?
There is no known exploitation of CVE-2026-107697 in the wild and no public exploit code.
Other vulnerabilities in Ffmpeg Ffmpeg
Sources
Also known as DEBIAN-CVE-2026-107697, ECHO-a1b6-5fc7-f6ea, GHSA-hhvh-2vr7-77mx, MINI-jgq2-r8rc-x5xm, UBUNTU-CVE-2026-107697.