{"id":"CVE-2020-13904","details":"FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c.","modified":"2026-08-17T05:26:21.020005Z","published":"2020-06-07T19:15:09.703Z","related":["SUSE-SU-2021:2322-1","SUSE-SU-2021:2929-1","openSUSE-SU-2021:2322-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"],"extracted_events":[{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"18.04"},{"last_affected":"18.04"},{"introduced":"20.04"},{"last_affected":"20.04"}],"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux"},{"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"},{"introduced":"10.0"},{"last_affected":"10.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200529033905.41926-1-lq%40chinaffmpeg.org/"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00022.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202007-58"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4431-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2020/dsa-4722"},{"type":"REPORT","url":"https://trac.ffmpeg.org/ticket/8673"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/6959358683c7533f586c07a766acc5fe9544d8b2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.ffmpeg.org/ffmpeg.git","events":[{"introduced":"58142a27ea96bf9246586a91a82db85e37646933"},{"last_affected":"d3b963cc41824a3c5b2758ac896fb23e20a87875"}],"database_specific":{"cpe":["cpe:2.3:a:ffmpeg:ffmpeg:2.8:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg:4.2.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.8"},{"last_affected":"2.8"},{"introduced":"4.2.3"},{"last_affected":"4.2.3"}],"source":"CPE_STRING"}}],"versions":["2.8","4.2.3","n4.2.3","n4.2.2","n4.2.1","n4.2","n4.2-dev","n4.1-dev","n3.5-dev","n3.4-dev","n3.3-dev","n3.2-dev","n3.1-dev","n2.9-dev","n2.8-dev"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13904.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ffmpeg/ffmpeg","events":[{"introduced":"58142a27ea96bf9246586a91a82db85e37646933"},{"last_affected":"d3b963cc41824a3c5b2758ac896fb23e20a87875"},{"fixed":"6959358683c7533f586c07a766acc5fe9544d8b2"}],"database_specific":{"cpe":["cpe:2.3:a:ffmpeg:ffmpeg:2.8:*:*:*:*:*:*:*","cpe:2.3:a:ffmpeg:ffmpeg:4.2.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2.8"},{"last_affected":"2.8"},{"introduced":"4.2.3"},{"last_affected":"4.2.3"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["2.8","4.2.3","n2.8.16","n4.2.3","n4.2.2","n4.2.1","n4.2","n4.2-dev","n2.8.15","n4.1-dev","n2.8.14","n2.8.13","n3.5-dev","n2.8.12","n3.4-dev","n2.8.11","n2.8.10","n2.8.9","n3.3-dev","n2.8.8","n2.8.7","n3.2-dev","n3.1-dev","n2.8.6","n2.8.5","n2.8.4","n2.8.3","n2.8.2","n2.8.1","n2.8","n2.9-dev","n2.8-dev"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-13904.json","vanir_signatures_modified":"2026-08-17T05:26:21Z","vanir_signatures":[{"id":"CVE-2020-13904-2b8821e2","signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/6959358683c7533f586c07a766acc5fe9544d8b2","target":{"file":"libavformat/hls.c"},"deprecated":false,"digest":{"line_hashes":["158144811077034995109933837677768601857","281751093908803107971940014393508807726","240764462031438200492845385032705040109","15703913043383878175200160282698241320","138080608107875226115977774548120949879","259048102838479733394805058517030239279","17084527969274049166290416022132557131","269990059958938381327368365588722984632"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/6959358683c7533f586c07a766acc5fe9544d8b2","target":{"file":"libavformat/hls.c","function":"parse_playlist"},"deprecated":false,"digest":{"function_hash":"45061495392761575669141487341416533816","length":4983},"id":"CVE-2020-13904-f5815e55"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}