CVE-2026-75145 in FFmpeg
Summary
by MITRE • 08/19/2026
FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in FFmpeg prior to commit b4c199c represents a critical integer narrowing conversion flaw within the AV1 RTP packetizer module located at libavformat/rtpenc_av1.c. This issue stems from an improper handling of data type conversions when processing Open Bitstream Unit sizes, which are fundamental components of the AV1 video codec structure used in real-time streaming scenarios. The core technical defect arises during the comparison logic that determines whether a specific OBU fits within the remaining frame size allocated for RTP payload transmission. Specifically, the code casts the unsigned integer representing the OBU size to a signed long type before performing this comparative check against the available buffer space. This design choice introduces a significant architectural weakness on platforms where the long data type is limited to 32 bits in width, which notably includes many common environments such as 64-bit Windows systems and certain embedded architectures that adhere to specific ABI conventions regarding integer sizes.
The operational consequence of this flawed casting mechanism is severe due to sign extension behavior inherent in signed arithmetic operations on constrained bit-widths. When the original OBU size value exceeds the maximum positive limit representable by a 32-bit signed long, typically two billion one hundred forty-seven million four hundred eighty-three thousand six hundred forty-seven bytes, the most significant bit of the unsigned integer is interpreted as a sign bit during the conversion process. This results in the value being transformed into a negative number through two's complement representation logic. Because the subsequent conditional check compares this now-negative long value against the remaining frame size using standard relational operators, the condition erroneously evaluates to true since any negative signed integer is mathematically less than positive unsigned or signed integers representing available buffer space. Consequently, the safety bound designed to prevent oversized packets from being processed is effectively bypassed on these affected platforms.
This logic error directly leads to an out-of-bounds memory access vulnerability with high severity implications for system stability and security integrity. Once the flawed check passes, the application proceeds to use the original or improperly handled size value as a copy length parameter in subsequent memory operations such as memcpy or similar buffer filling routines. Since the actual data being copied corresponds to the oversized OBU rather than the limited remaining frame space, the write operation exceeds the boundaries of the allocated destination buffer. This out-of-bounds write can corrupt adjacent heap metadata, overwrite critical control structures, or trigger segmentation faults depending on memory layout and allocation patterns. In malicious scenarios, an attacker could craft a specially constructed AV1 RTP stream containing oversized OBUs to exploit this condition, potentially achieving arbitrary code execution through precise heap exploitation techniques if the corrupted data includes function pointers or object headers that are subsequently dereferenced by the application logic.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-682 Incorrect Calculation, as it involves improper arithmetic operations leading to unexpected behavior in security-critical bounds checking. The exploitation vector relates closely to ATT&CK technique T1190 Exploit Public-Facing Application, particularly within the context of media processing pipelines where untrusted input is ingested without sufficient validation at multiple layers. Mitigation strategies must prioritize updating FFmpeg to versions post-commit b4c199c which corrects this casting logic by ensuring that comparisons are performed using types with consistent width and sign semantics appropriate for size calculations, typically utilizing unsigned long or explicit 64-bit integer types regardless of platform ABI defaults. Additionally, developers should implement defensive programming practices such as validating input sizes against maximum allowable limits before any type conversions occur and employing static analysis tools configured to detect narrowing conversions that may result in data loss or sign inversion during security-sensitive comparisons.