Description

A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T20:17:03.123Z",
  "pubdate": "2026-09-14T20:17:03.123Z",
  "executiveSummary": "A critical denial-of-service vulnerability exists in the FFmpeg 8.0.x HLS protocol handler. The flaw resides within the Duration Parser component, specifically within the parse_playlist function in libavformat/hlsproto.c. An unauthenticated remote attacker can exploit this vulnerability by supplying a maliciously crafted playlist file containing specifically manipulated 'duration' or 'target_duration' attributes. Successful exploitation leads to an application crash or service interruption, effectively causing a denial-of-service condition. This vulnerability is mitigated by upgrading the FFmpeg installation to versions 8.1 or 9.0, which contain the necessary logic fix identified by patch 64fafd63f0b4.",
  "technicalDetails": "The vulnerability is located in libavformat/hlsproto.c, specifically within the parse_playlist function responsible for processing HLS (HTTP Live Streaming) playlist manifests. The flaw stems from improper validation and handling of the 'duration' or 'target_duration' fields provided within the HLS stream data. When the parser encounters these specific fields, it fails to perform adequate bounds checking or sanity verification on the supplied input before attempting to process the data.\nThe attack flow begins when an attacker provides a remote HLS stream to an application utilizing the affected FFmpeg 8.0.x library. By injecting malformed or logically inconsistent values into the duration-related tags of the playlist file, the attacker can force the parse_playlist function into an undefined state. This typically triggers an out-of-bounds access, integer overflow, or null pointer dereference, depending on the specific memory layout and the malformed value provided.\nBecause the HLS protocol often involves recursive parsing of nested manifests and segment metadata, the processing logic in hlsproto.c must handle various input types dynamically. The vulnerability allows an attacker to bypass internal input sanitization, causing the parsing thread to crash during the execution of mathematical or logical operations on the manipulated duration values. This impact is significant because FFmpeg is frequently used in media servers and transcoders, where an unauthenticated remote user can trigger a process crash without requiring elevated privileges or prior authentication.\nThe remediation patch, identified as 64fafd63f0b4, introduces robust validation logic to ensure that duration attributes adhere to expected constraints before they are utilized by the parser. By failing to validate the input length and type during the initial ingestion phase, the vulnerable version of the library allows for memory corruption or logic errors that directly terminate the host process, meeting the criteria for a denial-of-service attack. The vulnerability does not appear to facilitate arbitrary code execution but effectively compromises the availability of the FFmpeg-powered service."
}