CyberRota Analysis
AI-GeneratedFFmpeg versions prior to 8.1.3 are vulnerable due to a failure in the HLS demuxer’s protection mechanism, allowing attackers to bypass restrictions on protocols and allowed extensions when accessing child playlists. This vulnerability enables the execution of disallowed protocols or the opening of non-multimedia local files, potentially leading to unauthorized resource access. Organizations using FFmpeg for media processing should prioritize updating to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.
Related CVEs
Other vulnerabilities affecting the same vendor(s)