CVE-2026-90816CWE-404

CVE-2026-90816

Medium · published September 15, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00580 · 47.0th percentile
Weakness
CWE-404 · Improper Resource Shutdown or Release
Published
2026-09-15T00:17Z
References (8)
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4 · [email protected]https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492 · [email protected]https://ffmpeg.org/ · [email protected]https://vuldb.com/cve/CVE-2026-90816 · [email protected]https://vuldb.com/submit/922626 · [email protected]https://vuldb.com/vuln/403318 · [email protected]https://vuldb.com/vuln/403318/cti · [email protected]https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 20:00Z
    FFmpeg Duration hlsproto.c parse_playlist denial of service
    cvelistv5