PT-2026-41612 · Julia · Mpv Jll

Published 2026-05-07 · Updated 2026-05-07

OSV

A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file.

Related Identifiers

JLSEC-2026-476

Affected Products

Mpv Jll

References · 6

• https://osv.dev/vulnerability/JLSEC-2026-476 · Vendor Advisory
• https://github.com/mpv-player/mpv/releases/tag/v0.33.1 · Note
• https://github.com/mpv-player/mpv/commit/d0c530919d8cd4d7a774e38ab064e0fabdae34e6 · Note
• https://mpv.io · Note
• https://security.gentoo.org/glsa/202107-46 · Note
• https://devel0pment.de/?p=2217 · Note