Executive brief
FFmpeg's HLS (HTTP Live Streaming) protocol handler parses playlist files that describe video segments. An attacker can craft a malicious playlist with zero or invalid duration values, causing FFmpeg to enter an infinite loop that consumes 100% CPU and makes the application unresponsive, disrupting video streaming services.
Technical details
The vulnerability is a denial-of-service condition in the parse_playlist() function of libavformat/hlsproto.c. The function lacks validation when parsing EXTINF duration and EXT-X-TARGETDURATION values from HLS playlist files; when these values are set to zero, the reload_interval variable becomes zero, causing the hls_read() function to execute a tight loop with a condition that is always true (av_gettime_relative() - last_load_time >= 0), skipping the av_usleep() call and repeatedly calling parse_playlist() without delay. The attack is remotely exploitable via a crafted HLS playlist file (local or remote). A similar vulnerability was fixed in hls.c but the fix was not backported to hlsproto.c. Patches are available in FFmpeg 8.1 and later (commit 64fafd63f0b4 removes the vulnerable protocol handler entirely).
Affected products
- FFmpeg FFmpeg 8.0.x
Timeline
- 2026-01-16: disclosed
- 2026-09-14: advisory: CVE-2026-90816 published
- 2025-07-08: patched: HLS protocol handler removed in commit 64fafd63f0b4