CVE Alert: CVE-2026-123095 – mpv-player

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution.

**Risk verdict:** High potential impact, but exploitation urgency cannot be confirmed because KEV, SSVC, PoC and EPSS data were not provided.

**Why this matters:** A crafted media feed or page could turn a normal playback action into access to local files or code execution in the player’s security context. Likely attacker goals include stealing accessible data, tampering with user files, or compromising the endpoint; impact depends on the player’s permissions and available plugins.

**Most likely attack path:** An attacker supplies a malicious playlist URL through a feed or page, and a user loads it in the player; network reachability and no prior account access are indicated, but user interaction remains a practical prerequisite. The newer scoring indicates lower attack complexity, while another assessment indicates higher complexity, so exploit reliability is uncertain; scope is unchanged, with no stated lateral-movement impact.

**Who is most exposed:** Users and organisations that open third-party streams, playlists or web-sourced media in desktop environments are the main concern, particularly where the player can access sensitive files or plugins.

Review player launches involving untrusted URLs or playlist sources.

Alert on unexpected `file://` or `av://` playlist entries.

Monitor player child processes, unusual file reads and shared-library loads.

Check endpoint logs for suspicious plugin or audio-filter activity.

Mitigation and prioritisation:

Upgrade to the fixed release; prioritise fleet-wide remediation.

Until patched, disable the affected hook or avoid untrusted playlists.

Restrict player access to sensitive files and unnecessary plugins.

Test configuration changes before broad deployment; confirm KEV, SSVC and EPSS status for urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.