CVE-2026-30754 in FFmpeg
Summary
by MITRE • 09/09/2026
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in FFmpeg versions prior to 8.1 represents a critical memory corruption flaw located within the Real-time Transport Protocol encoding subsystem, specifically affecting the handling of H.264 and HEVC video streams. The root cause resides in the nal_send function found in the libavformat/rtpenc_h264_hevc.c source file. This component is responsible for encapsulating network access units into RTP packets for transmission over IP networks. During normal operation, this module expects valid positive integer values representing payload sizes to safely copy data from internal buffers to outgoing packet structures. However, under specific conditions triggered by a crafted input file, the application fails to adequately validate the size parameter before invoking standard memory copying routines.
The technical mechanism of exploitation involves the passage of a negative value, specifically -3, as the size argument to the memcpy function. In C programming languages and most modern operating systems, integer types are typically signed unless explicitly declared otherwise. When a negative number is passed to a function expecting an unsigned or positive length parameter for memory operations, it results in an integer underflow or wrap-around effect due to two's complement representation. Consequently, the large unsigned equivalent of -3 is interpreted as a massive byte count, causing memcpy to attempt copying data from invalid memory locations far beyond the intended buffer boundaries. This behavior leads to out-of-bounds read access and potentially heap-based buffer overflow conditions depending on the surrounding memory layout and allocation sizes.
From an operational impact perspective, this vulnerability allows for arbitrary code execution or denial of service against systems processing maliciously crafted video streams via RTP. An attacker who can supply a specially constructed input file containing malformed H.264 or HEVC metadata could trigger this condition remotely if the FFmpeg instance is configured to accept and process such streams without rigorous pre-validation. The use of AddressSanitizer during detection confirms that the memory access violations are immediate and detectable, indicating high reliability in triggering the flaw. Successful exploitation could lead to information disclosure through out-of-bounds reads or complete system compromise via code execution resulting from heap corruption.
This vulnerability aligns with Common Weakness Enumeration category CWE-190 Integer Overflow or Wraparound, as the negative size value results from improper handling of signed integers where unsigned interpretation is assumed by subsequent memory functions. It also relates to CWE-787 Out-of-bounds Write and CWE-125 Out-of-bounds Read depending on whether the oversized copy overwrites adjacent heap metadata or merely reads sensitive data outside allocated regions. In terms of MITRE ATT&CK mapping, this flaw facilitates initial access techniques involving crafted media files, potentially supporting exploitation paths categorized under Command and Control via RTP streams if used in conjunction with other vulnerabilities to establish persistent footholds within networked environments.
Mitigation strategies primarily involve upgrading FFmpeg to version 8.1 or later where the nal_send function has been patched to include rigorous validation of size parameters before memory operations are executed. Developers integrating FFmpeg into their applications should ensure that all input streams undergo strict format verification and length checks prior to encoding processes. Additionally, employing compiler-based protections such as stack canaries, AddressSanitizer during development phases, and heap hardening techniques like ASAN or UBSan can help detect similar issues early in the software lifecycle. Network-level defenses including deep packet inspection for RTP payloads may also provide an additional layer of security by filtering out malformed packets before they reach vulnerable media processing components.