CVE-2026-75144 in FFmpeg
Summary
by MITRE • 08/19/2026
FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in FFmpeg prior to commit 1cdeb3c represents a critical memory safety issue within the VC-2 and Dirac RTP packetizer module located at libavformat/rtpenc_vc2hq.c. This flaw stems from an improper boundary check during the processing of incoming media streams, specifically when handling Dirac data units or fragments intended for Real-time Transport Protocol output. The core technical deficiency lies in the mechanism used to copy input-derived size information into a fixed-size buffer without validating that the source length does not exceed the destination capacity. When a malicious actor supplies a crafted Dirac data unit with an oversized fragment header, the packetizer proceeds to execute a memory copy operation that writes beyond the allocated heap boundaries. This lack of upper bound verification allows for arbitrary write operations in adjacent memory regions, leading directly to heap buffer overflow conditions that can destabilize the application runtime environment and potentially facilitate remote code execution if exploited effectively by an attacker with network access to the processing service.
From a classification perspective, this vulnerability aligns closely with CWE-120, which denotes Buffer Copy without Checking Size of Input Classic Buffer Overflow. The specific operational context involves media stream parsing where external input is assumed to be well-formed or safely bounded, a common assumption in legacy multimedia frameworks that has proven risky as attack vectors evolve. In terms of adversary behavior mapping under the MITRE ATT&CK framework, this flaw facilitates initial access and execution phases through techniques associated with exploitation for privilege escalation or system compromise via memory corruption. Attackers can leverage such vulnerabilities to inject shellcode into the process memory space by carefully crafting the overflow payload to overwrite function pointers or return addresses on the heap stack. The impact extends beyond simple application crashes; successful exploitation could allow an attacker to gain control over the underlying operating system processes running FFmpeg, particularly in scenarios where the software is used as a server-side transcoder for streaming services that accept untrusted video inputs from clients.
The operational impact of this vulnerability is severe due to the widespread adoption of FFmpeg across various media processing pipelines, including live streaming platforms, video conferencing tools, and content delivery networks. If an attacker can trigger this overflow through specially crafted RTP packets containing Dirac codec data, they may achieve arbitrary code execution with the privileges of the user running the FFmpeg instance. This poses significant risks to infrastructure integrity, confidentiality, and availability. For organizations relying on real-time media processing, such a flaw could lead to denial-of-service conditions via segmentation faults or more sophisticated attacks involving persistent backdoors installed through memory manipulation. The absence of strict size validation in the packetization logic means that any entity capable of sending RTP streams with malformed Dirac headers can potentially exploit this weakness without requiring authentication, making it particularly dangerous in public-facing media services.
Mitigation strategies must prioritize immediate patching to version 1cdeb3c or later where the boundary checks have been implemented correctly within the rtpenc_vc2hq.c module. Developers should ensure that all input sizes derived from external sources are validated against buffer limits before any copy operations occur, adhering to secure coding standards such as those outlined in CWE-130 regarding improper handling of length parameter inconsistencies. Additionally, deploying runtime protection mechanisms like Address Space Layout Randomization and heap corruption detectors can help mitigate the impact of exploitation attempts even if legacy versions remain temporarily operational. Regular security audits focusing on media parsing libraries are essential to identify similar patterns where fixed-size buffers interact with dynamic input lengths without adequate sanitization or range checking procedures in place.