The vulnerability is an infinite loop flaw in the HLS demuxer of FFmpeg versions prior to 8.1.3. The parser treats Master Playlist tags within Media Playlists, allowing an attacker to craft a self‑referencing playlist that never terminates. This forces the demuxer to repeatedly add variants during header parsing, leading to unbounded CPU and I/O consumption. The effect is a denial of service on a system running the affected FFmpeg build.

FFmpeg, all releases older than 8.1.3. The problem exists in the core library avformat/hls.c, impacting any application that uses FFmpeg’s HLS playback capabilities.

The vulnerability has a CVSS score of 7.1, reflecting high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited documented exploitation. The likely attack vector is remote, via delivery of a malicious HLS playlist to a client or server that processes HLS streams. An attacker would need only to supply a crafted playlist; no authentication or privileged access is required.