HLS Demuxer Protection Mechanism Failure in FFmpeg

CVE-2026-107697

What is CVE-2026-107697?

FFmpeg versions prior to 8.1.3 exhibit a protection mechanism failure in the HLS demuxer, granting malicious actors the capability to circumvent protocol restrictions and bypass allowed extensions. By exploiting this vulnerability, attackers can present a crafted master playlist containing child playlists that utilize unsupported protocols or access non-multimedia local files. This results in an unauthorized opening of resources that the HLS security policy is designed to restrict, posing significant security risks in media handling.

References