CVE-2023-6603 is a high severity flaw in the HLS playlist parsing code of FFmpeg. A maliciously crafted playlist can trigger a NULL pointer dereference during initialisation and cause a denial of service. The record names no fixed version, so check the Red Hat bug and your distribution.
What's affected
- Product: FFmpeg.
- Affected: the record gives no version range.
- Fixed version: not named in the record. The only reference is Red Hat Bugzilla 2334335.
- Trigger: a crafted HLS playlist, over the network, with no privileges.
The record gives a CVSS 3.1 base score of 7.5 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
ffmpeg -version
rpm -q ffmpeg
dpkg -l | grep -i ffmpeg
FFmpeg is often bundled inside other products, so also check container images and applications that process video. Services that accept HLS playlist URLs from users or other systems are the ones to look at first.
What to do now
- Find systems that run FFmpeg, including container images and video processing services.
- Check your distribution tracker and the Red Hat bug for a fixed package.
- Where you cannot patch yet, avoid feeding FFmpeg playlists from untrusted sources, and run it in a sandbox with restart on crash.
- Add timeouts and process limits so a crash does not take down the whole pipeline.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-476 (NULL Pointer Dereference): Code uses a pointer that was never set, which normally ends in a crash of the process or, in a kernel, of the whole machine.
A NULL pointer dereference in a parser is a crash bug. The code assumes a structure was created, and with a crafted input it was not. The process stops. The record rates the impact as availability only.
For desktop use the risk is small. For services that fetch and transcode playlists on behalf of users, a single bad playlist can stop a worker, and repeated ones can keep a queue down. Isolation and automatic restart reduce the harm while you wait for a package.
Try it yourself
This demo shows how to spot findings that already have a fix available, which is a quick way to sort your FFmpeg and other media library updates.
Click through it at your own pace, or open it full screen.
Quick check
Can this run code?
The record describes only a denial of service from a NULL pointer dereference.
Is a fixed version known?
The record names none. Use the Red Hat bug page and your distribution tracker.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
