CVE-2026-107697
Description
A flaw was found in FFmpeg's HTTP Live Streaming (HLS) demuxer. A remote attacker can exploit this issue by supplying a specially crafted master playlist that references disallowed protocols or local files. This bypasses security restrictions and causes the application to open restricted resources, potentially resulting in unauthorized information disclosure.
Statement
This vulnerability is rated as Moderate severity because exploitation requires user interaction to ingest malicious media files and is confined to unauthorized access to local resources or unintended protocols without enabling arbitrary code execution. Within Red Hat environments, such as Red Hat Enterprise Linux AI and Red Hat OpenShift AI containers, FFmpeg operates as a supporting multimedia processing component rather than an exposed network daemon. Consequently, the flaw can only be triggered if a pipeline or user processes untrusted HLS playlists designed to circumvent demuxer protocol restrictions.
Mitigation
Operational controls and sandboxing can partially mitigate this vulnerability:
1. Avoid processing untrusted or unknown HTTP Live Streaming (HLS) playlists from unverified sources.
2. Isolate media processing workloads by executing FFmpeg within a restricted sandbox or container environment. Restrict the process from accessing sensitive local files and enforce network egress filtering to block requests to internal networks or unintended protocols.
Caveats: Restricting local filesystem and network access may impact FFmpeg workflows that require reading distributed media segments or writing to shared storage locations.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | 4.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
