CVE-2026-107695
Description
A flaw was found in FFmpeg. An infinite loop vulnerability in the HTTP Live Streaming (HLS) demuxer allows remote attackers to cause a Denial of Service (DoS). By tricking a user into processing a specially crafted, self-referencing playlist file, an attacker can force the application into an endless loop, resulting in excessive CPU consumption and causing the application to hang.
Statement
This vulnerability is rated Moderate because exploitation requires user interaction to process an untrusted media playlist and results strictly in a denial of service without threatening data confidentiality, system integrity, or enabling code execution. Within Red Hat products such as Red Hat Enterprise Linux AI, FFmpeg functions as a multimedia processing library rather than an exposed listening service, limiting the blast radius to the specific application or container consuming the malicious stream. Workloads that do not parse external or untrusted HTTP Live Streaming (HLS) content remain unaffected by this flaw.
Mitigation
Avoid processing untrusted HLS playlists and sandbox media decoding workloads:
1. Operational control:
Do not open, decode, or process untrusted HLS (.m3u8) playlists or media streams from unverified sources.
2. Sandboxing:
For pipelines or containerized services that ingest external media files, isolate FFmpeg execution within a restricted container or sandbox with enforced CPU quotas and process execution timeouts to prevent unbounded resource exhaustion from impacting the host system.
3. Caveats:
Enforcing strict execution time limits or CPU quotas may cause legitimate, resource-intensive media processing jobs to terminate prematurely.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
