CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

Linux Distros Unpatched Vulnerability : CVE-2026-123095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by...

UBUNTU-CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

CVE-2026-123095

A flaw was found in mpv. A remote attacker who controls a media feed or webpage can exploit this vulnerability by injecting newline characters into playlist URLs processed by the bundled ytdlhook script. This allows the attacker to bypass URL safety checks and load arbitrary local files or shared...

CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

DEBIAN-CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

CVE-2026-123095

The mpv media player (versions 0.29.0 before 0.42.0 ) is vulnerable to a playlist injection flaw in the bundled ytdl_hook script. The root cause is the improper neutralization of CRLF sequences, allowing remote attackers to bypass the url_is_safe() check by embedding newlines in playlist URLs. Th...

EUVD-2026-117540

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

CVE-2026-123095 mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

CVE-2026-123095 mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

[SECURITY] Fedora 45 Update: mpv-mpris-1.2-4.fc45

mpv-mpris allows control of mpv using standard media keys This plugin implements the MPRIS D-Bus interface and can be controlled using tools such as playerctl or through many Linux DEs, such as Gnome and KDE...

[SECURITY] Fedora 45 Update: mpv-0.41.0-10.fc45

Mpv is a movie player based on MPlayer and mplayer2. It supports a wide varie ty of video file formats, audio and video codecs, and subtitle types. Special input URL types are available to read input from a variety of sources other than disk files. Depending on platform, a variety of different...

mpv:fuzzer_protocol_lavf: Use-of-uninitialized-value in pcm_decode_frame

Project: https://github.com/mpv-player/mpv.git Detailed Report: https://oss-fuzz.com/testcase?key=5159782181568512 Project: mpv Fuzzing Engine: libFuzzer Fuzz Target: fuzzerprotocollavf Job Type: libfuzzermsanmpv Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State...

SUSE CVE-2026-68139

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

ANT-2026-3T6Q6WE9 · mpv · Heap Buffer Overflow

oob-write low Severity Claude low · Security research firm low · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-3T6Q6WE9: Integer overflow in scaletempo audio filter leading to...

CVE-2026-68139

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

CVE-2026-68139

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

EUVD-2026-55520

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the reported failure, the first relevant device error was: pcieport...

CVE-2026-68139

CVE-2026-68139 affects the Linux kernel mlx5e/MPV path. After PCIe DPC recovery, mlx5 reloads affected PCIe functions and replays multiport affiliation events; during resume, an RDMA multiport binding replay triggers an MPV_DEVCOM_MASTER_UP. The host panics with a NULL pointer dereference in mlx5...