CVE-2026-75141 in FFmpeg
Summary
by MITRE • 08/19/2026
FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in FFmpeg prior to commit acf5d7c represents a critical memory safety issue located within the hvcC box writer component of the multimedia framework. This specific flaw is classified as a heap buffer overflow, which corresponds to CWE-122 in the Common Weakness Enumeration taxonomy. The root cause lies in the logic responsible for constructing HEVC configuration records during the muxing process. When FFmpeg processes an input file containing High Efficiency Video Coding data, it must serialize this information into an hvcC box within the output container format. This serialization involves writing a count field that indicates how many Network Abstraction Layer units of each type are present in the stream.
The technical flaw manifests when the number of NAL units belonging to a single type exceeds the maximum value representable by the integer data structure used for the count field. Instead of validating this limit or handling the overflow condition gracefully, the software performs an arithmetic operation that wraps around due to integer overflow behavior. This results in a significantly smaller size being allocated on the heap than what is actually required to store the NAL unit data. Consequently, when the application proceeds to write the actual NAL units into this undersized buffer, it writes beyond the bounds of the allocated memory region.
This out-of-bounds write operation allows an attacker who can supply a crafted HEVC input file to overwrite adjacent heap metadata or arbitrary memory locations during the muxing phase. The operational impact is severe, as successful exploitation can lead to application crashes resulting in denial of service conditions. More critically, depending on the specific heap allocator implementation and the data written beyond the buffer boundary, an attacker may achieve remote code execution with the privileges of the process running FFmpeg. This aligns with ATT&CK technique T1203, which covers Exploitation for Client Execution, particularly in scenarios where users are tricked into opening malicious media files that trigger automatic processing or conversion by vulnerable software versions.
Mitigation strategies primarily involve upgrading to a version of FFmpeg released after commit acf5d7c, which includes the necessary patches to validate input parameters and prevent integer overflows during buffer size calculations. For environments where immediate patching is not feasible, implementing strict input validation at the ingestion layer can help filter out malformed HEVC streams before they reach the vulnerable muxer component. Additionally, deploying runtime protection mechanisms such as heap hardening features provided by modern operating systems can mitigate the impact of memory corruption vulnerabilities by detecting and terminating processes that exhibit abnormal memory access patterns.