CVE-2026-90816

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-90816", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-13T16:32:04.243Z", "datePublished": "2026-09-14T20:00:05.185Z", "dateUpdated": "2026-09-15T19:31:29.406Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-14T20:00:05.185Z"}, "title": "FFmpeg Duration hlsproto.c parse_playlist denial of service", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-404", "lang": "en", "description": "Denial of Service"}]}], "affected": [{"vendor": "n/a", "product": "FFmpeg", "versions": [{"version": "8.0.*", "status": "affected"}, {"version": "8.1", "status": "unaffected"}, {"version": "9.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"], "modules": ["Duration Parser"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-09-13T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-13T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-13T18:37:24.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Kery Qi (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/403318", "name": "VDB-403318 | FFmpeg Duration hlsproto.c parse_playlist denial of service", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/403318/cti", "name": "VDB-403318 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-90816", "name": "CVE-2026-90816 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/922626", "name": "Submit #922626 | FFmpeg FFmpeg \u2264 8.0.x Denial of Service", "tags": ["third-party-advisory"]}, {"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492", "tags": ["issue-tracking"]}, {"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4", "tags": ["patch"]}, {"url": "https://ffmpeg.org/", "tags": ["product"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"references": [{"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-15T19:31:13.282602Z", "id": "CVE-2026-90816", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T19:31:29.406Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-90816", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-15T19:31:13.282602Z"}}}], "references": [{"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T19:31:23.814Z"}}], "cna": {"tags": ["x_open-source"], "title": "FFmpeg Duration hlsproto.c parse_playlist denial of service", "credits": [{"lang": "en", "type": "reporter", "value": "Kery Qi (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["Duration Parser"], "product": "FFmpeg", "versions": [{"status": "affected", "version": "8.0.*"}, {"status": "unaffected", "version": "8.1"}, {"status": "unaffected", "version": "9.0"}]}], "timeline": [{"lang": "en", "time": "2026-09-13T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-13T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-13T18:37:24.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/403318", "name": "VDB-403318 | FFmpeg Duration hlsproto.c parse_playlist denial of service", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/403318/cti", "name": "VDB-403318 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-90816", "name": "CVE-2026-90816 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/922626", "name": "Submit #922626 | FFmpeg FFmpeg \u2264 8.0.x Denial of Service", "tags": ["third-party-advisory"]}, {"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492", "tags": ["issue-tracking"]}, {"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4", "tags": ["patch"]}, {"url": "https://ffmpeg.org/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "Denial of Service"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-14T20:00:05.185Z"}}}, "cveMetadata": {"cveId": "CVE-2026-90816", "state": "PUBLISHED", "dateUpdated": "2026-09-15T19:31:29.406Z", "dateReserved": "2026-09-13T16:32:04.243Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-14T20:00:05.185Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*"], "modules": ["Duration Parser"], "product": "FFmpeg", "vendor": "n/a", "versions": [{"status": "affected", "version": "8.0.*"}, {"status": "unaffected", "version": "8.1"}, {"status": "unaffected", "version": "9.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}], "id": "CVE-2026-90816", "lastModified": "2026-09-15T20:19:20.400", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-90816", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-15T19:31:13.282602Z", "version": "2.0.3"}}]}, "published": "2026-09-14T20:17:03.123", "references": [{"source": "cna@vuldb.com", "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4"}, {"source": "cna@vuldb.com", "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492"}, {"source": "cna@vuldb.com", "url": "https://ffmpeg.org/"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-90816"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/922626"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/403318"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/403318/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ffmpeg: CPU exhaustion when processing a crafted HLS playlist", "id": "2533346", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533346"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended.", "A flaw was found in FFmpeg. A CPU exhaustion issue can occur in the HLS protocol module when handling a specially crafted HLS (HTTP Live Streaming) playlist due to insufficient validation of duration or target_duration parameters. This vulnerability can lead to an excessive consumption of CPU resources, eventually resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "Do not process untrusted HLS playlists using FFmpeg."}, "name": "CVE-2026-90816", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "ffmpeg", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "rhelai3/bootc-aws-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "rhelai3/bootc-azure-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "rhelai3/bootc-azure-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "rhelai3/bootc-gcp-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-vllm-gaudi-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-09-14T20:00:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-90816\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-90816\nhttps://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4\nhttps://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492\nhttps://ffmpeg.org/\nhttps://vuldb.com/cve/CVE-2026-90816\nhttps://vuldb.com/submit/922626\nhttps://vuldb.com/vuln/403318\nhttps://vuldb.com/vuln/403318/cti"], "statement": "To exploit this issue, an attacker needs to convince a user to process a specially crafted HLS (HTTP Live Streaming) playlist, limiting its exposure. Furthermore, this vulnerability can cause an excessive consumption of CPU resources, eventually resulting in a denial of service, with no other security impact. For these reasons, this flaw has been rated with a moderate severity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "8.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "9.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FFmpeg", "source": "cna", "vendor": "n/a"}, "product": "ffmpeg", "vendor": "ffmpeg"}], "created": "2026-09-15T07:00:13.854475+00:00", "updated": "2026-09-20T22:45:05.092118+00:00", "vendors": ["ffmpeg", "ffmpeg$PRODUCT$ffmpeg"]}