CVE-2026-90816 FFmpeg Duration hlsproto.c parse_playlist denial of service
Remote attackers can cause a denial of service in FFmpeg by manipulating duration arguments in HLS playlist parsing, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-90816?
CVE-2026-90816 is a medium-severity denial of service vulnerability in FFmpeg, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended.
Weakness: CWE-404
Which versions are affected by CVE-2026-90816?
How do I fix CVE-2026-90816?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-90816 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-90816 exists.
Sources
Also known as DEBIAN-CVE-2026-90816, ECHO-0947-a5db-6850, GHSA-p2jm-whqf-vrvv, UBUNTU-CVE-2026-90816.