CVE-2016-1897

CVE-2016-1897 describes a vulnerability in FFmpeg 2.x that allows remote attackers to perform cross-origin attacks and read arbitrary local files. This is achieved by crafting an HLS M3U8 file that utilizes the concat protocol, leading to an external HTTP request containing the first line of a local file. The vulnerability is rated Medium severity (CVSS 5.5), with a low attack complexity and requiring user interaction, potentially leading to high confidentiality impact. Despite its high FAUCET Risk Score and above-average EPSS score, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.