CVE-2026-90816: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-90816 is a denial-of-service vulnerability in FFmpeg 8.0.x affecting the parse_playlist function in libavformat/hlsproto.c within the HLS Duration Parser component. Manipulation of the duration or target_duration arguments can cause improper resource shutdown or release, leading to a denial-of-service condition. The vulnerability was published on September 14, 2026, and is currently awaiting full NVD analysis. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Feedly, VulDB).

The root cause is classified as CWE-404 (Improper Resource Shutdown or Release), where the parse_playlist function in libavformat/hlsproto.c fails to properly handle malformed or unexpected values in the duration and target_duration fields of an HLS playlist. An attacker can exploit this remotely by serving a crafted HLS playlist to a vulnerable FFmpeg 8.0.x client, requiring user interaction (e.g., the user opening or processing the malicious stream). The fix is identified as commit 64fafd63f0b4 in the FFmpeg repository (VulDB, FFmpeg Commit, FFmpeg Issue).

Successful exploitation results in a denial-of-service condition limited to availability impact (low severity), with no confidentiality or integrity compromise. An attacker who can cause a user or automated system to process a malicious HLS playlist can crash or hang the affected FFmpeg process, disrupting media processing pipelines or applications relying on FFmpeg for streaming. The scope is unchanged, meaning the impact is confined to the vulnerable component itself without lateral spread (Feedly, VulDB).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-90816. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must open or process a crafted HLS stream — which further reduces practical exploitability (Feedly, VulDB).

1. Craft malicious HLS playlist: Create an .m3u8 HLS playlist file containing malformed or extreme values in the #EXTINF (duration) or #EXT-X-TARGETDURATION (target_duration) tags designed to trigger improper resource handling in FFmpeg's parse_playlist function.
2. Host the payload: Serve the crafted playlist from an attacker-controlled HTTP/HTTPS server or embed it in a media-sharing context accessible to the target.
3. Induce victim interaction: Trick a user or automated media processing system running FFmpeg 8.0.x into opening the malicious HLS stream URL (e.g., via a phishing link, embedded player, or media ingest pipeline).
4. Trigger denial of service: FFmpeg's parse_playlist in libavformat/hlsproto.c processes the malformed duration values, triggering improper resource shutdown/release and causing the FFmpeg process to crash or become unresponsive (VulDB, FFmpeg Issue).

• Network: Unusual or repeated HTTP requests fetching .m3u8 playlist files from unknown or suspicious external hosts; HLS playlists with anomalous #EXTINF or #EXT-X-TARGETDURATION field values (e.g., negative numbers, extremely large integers, or non-numeric strings).
• Logs: FFmpeg process crash logs or error messages referencing hlsproto.c or parse_playlist; application logs showing unexpected FFmpeg process termination during HLS stream processing.
• Process: Unexpected termination or restart of FFmpeg processes; zombie or hung FFmpeg processes consuming resources without completing media processing tasks.

Users should upgrade FFmpeg from the affected 8.0.x branch to version 8.1 or 9.0, which contain the fix introduced in commit 64fafd63f0b4. No configuration-based workaround has been published; upgrading is the recommended remediation. As an interim measure, organizations can restrict FFmpeg-based applications from processing untrusted or externally sourced HLS streams until patching is complete (VulDB, FFmpeg Commit).