CVE-2026-90816

EUVD-2026-78057

14.09.2026, 20:17

A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 47.64%

Debian Releases

Debian Product

Codename

ffmpeg

bookworm	vulnerable
bookworm (security)	vulnerable
forky	7:9.0.2-3 fixed
sid	7:9.0.2-4 fixed
trixie	ignored
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

ffmpeg

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

libav

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage

Common Weakness Enumeration

CWE-404 - Improper Resource Shutdown or Release
The program does not release or incorrectly releases a resource before it is made available for re-use.

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4

https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492

https://ffmpeg.org/

https://vuldb.com/cve/CVE-2026-90816

https://vuldb.com/submit/922626

https://vuldb.com/vuln/403318

https://vuldb.com/vuln/403318/cti

https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492