CVE-2026-90816

medium

Description

A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended.

References

https://vuldb.com/vuln/403318/cti

https://vuldb.com/vuln/403318

https://vuldb.com/submit/922626

https://vuldb.com/cve/CVE-2026-90816

https://ffmpeg.org/

https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4

Details

Source: Mitre, NVD

Published: 2026-09-14

Updated: 2026-09-14

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Severity: Medium

CVSS v3

Base Score: 4.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Severity: Medium