CVE-2026-75143 in FFmpeg
Summary
by MITRE • 08/19/2026
FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in FFmpeg prior to commit 1c10bcc represents a critical heap-based buffer overflow within the Real-Time Streaming Protocol (RIST) implementation, specifically located in the libavformat/librist.c module. This flaw stems from a fundamental failure in input validation and boundary checking during data reception operations. The core technical issue lies in the behavior of the librist_read function, which is responsible for ingesting incoming network payloads into memory buffers provided by the calling context. Instead of respecting the size argument passed to it, which defines the maximum safe capacity of the destination buffer, the function blindly copies the entire length of the received payload regardless of whether that length exceeds the allocated space. This disregard for boundary constraints creates a classic heap overflow condition where data is written beyond the limits of the intended memory region into adjacent heap structures.
The operational impact of this vulnerability is severe due to its remote exploitability and potential for arbitrary code execution. An attacker acting as a remote RIST sender can trigger this flaw by transmitting specially crafted packets with payload sizes that exceed the buffer size allocated by the async wrapper associated with the async:rist:// URL scheme. The asynchronous nature of the FFmpeg I/O layer often results in smaller pre-allocated buffers being used for efficiency, making it highly probable that a standard or slightly oversized RIST packet will overflow these constraints. Successful exploitation allows an attacker to overwrite adjacent heap metadata or function pointers, potentially leading to remote code execution with the privileges of the user running the vulnerable FFmpeg instance. This poses significant risks in environments where media processing is performed on behalf of untrusted users or within cloud-based streaming services that accept external input streams.
From a classification perspective, this vulnerability aligns closely with CWE-120, which denotes Buffer Copy without Checking Size of Input Classic Buffer Overflow. The failure to validate the input size against the destination buffer capacity is the primary indicator of this weakness type. Furthermore, in terms of attack vectors and techniques, this flaw facilitates exploitation consistent with ATT&CK technique T1190, Exploit Public-Facing Application, as it targets a network service accessible from external networks. The use of the async wrapper further complicates mitigation efforts because the buffer size limitation is imposed by the asynchronous I/O layer rather than being explicitly controlled at the protocol parsing level, requiring fixes that address both the specific RIST reader logic and its interaction with the broader FFmpeg I/O architecture.
Mitigation strategies must prioritize immediate patching to version 1c10bcc or later where this boundary check has been corrected. For environments unable to update immediately, defensive measures should include deploying network-level access controls such as firewalls or intrusion prevention systems to restrict incoming RIST traffic to trusted sources only. Additionally, enabling Address Sanitizer (ASan) during testing phases can help detect similar heap overflow issues in other parts of the media processing pipeline before they reach production. Organizations relying on FFmpeg for critical infrastructure should also consider implementing strict input size limits at the application layer and utilizing memory-safe wrappers or libraries that enforce bounds checking automatically to reduce the risk of future buffer-related vulnerabilities.