The flaw is a protection mechanism failure in FFmpeg’s HLS demuxer that lets an attacker supply a crafted master playlist to bypass protocol and allowed_extensions checks performed by parse_playlist(). Because the function ignores these restrictions, child playlists can reference disallowed protocols or local non‑multimedia files, allowing the vulnerable process to open and read them as if they were permitted.

FFmpeg libraries older than version 8.1.3 that include the HLS demuxer are affected. Any application or service that processes HLS playlists—such as media servers, players, or streaming clients—necessarily uses the vulnerable component and can be impacted.

The CVSS score of 5.3 classifies this as medium severity, and the EPSS score is not available, indicating no known widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a remote, network‑based one: an attacker serves a malicious master playlist to a vulnerable FFmpeg instance. The exploit requires no local privileges; it only needs the ability to supply the playlist over the network. Successful exploitation can lead to unauthorized reading of local files or execution of non‑media content, potentially exposing sensitive data or providing a foothold for further attacks.