Skip to content
OpenAdvisories
High USN-7890-1 1 CVE

ffmpeg vulnerability

Published Nov 26, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that FFmpeg did not properly handle the parsing of
certain malformed HLS playlists. If a user were tricked into opening a
specially crafted HLS playlist, an attacker could possibly use this issue
to cause FFmpeg to crash, resulting in a denial of service.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ffmpeg 7:2.8.17-0ubuntu0.1+esm13

Vulnerabilities 1

  • High 7.5
    CVE-2023-6603

    Ffmpeg: null pointer dereference in ffmpeg hls parsing

    A flaw was found in FFmpeg's HLS playlist parsing. This vulnerability allows a denial of service via a maliciously crafted HLS playlist that triggers a null pointer dereference during initialization.

    ffmpeg ffmpeg libav Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2023-6603