« List of all CVEs

CVE-2023-6601

Ffmpeg: hls unsafe file extension bypass in ffmpeg

Published: 1/6/2025 Last updated: 11/3/2025 Reserved: 12/8/2023

A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions.

CNA assigner: fedora (92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5) Requested by: n/a

Metrics

Version Score Severity Vector String
3.1 4.7 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Opam packages affected (3)

conf-ffmpeg ffmpeg opus

Products affected (2)

Product Vendor Version
n/a
< *

References (4)