CVE-2026-75147 in FFmpeg
Summary
by MITRE • 08/19/2026
FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data. A crafted OBU size causes the remaining-size counter to wrap to a positive value, causing the next loop iteration to dereference a pointer beyond the end of the packet buffer. A crafted AV1 input packet muxed to RTP triggers the out-of-bounds read.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in FFmpeg prior to commit 983dae9 represents a critical memory safety issue within the AV1 RTP packetizer, specifically located in the libavformat/rtpenc_av1.c module. This flaw manifests as an out-of-bounds read that occurs during the processing of Advanced Video Coding (AV1) streams when they are being muxed into Real-time Transport Protocol packets. The root cause lies in a logical error within the keyframe detection loop, which is responsible for scanning incoming data to locate sequence headers represented by Object Unit Headers or OBUs. In standard AV1 stream parsing, these loops must carefully track buffer boundaries to ensure that memory access remains strictly within allocated limits. However, the implementation failed to validate the size of an individual OBU against the total remaining bytes in the packet before performing arithmetic operations on pointers and counters.
The technical mechanism of this vulnerability involves a classic integer overflow scenario leading to pointer dereference beyond valid memory regions. When processing an AV1 input packet, the loop calculates the next position by adding the encoded header length and the OBU payload size to the current pointer and remaining-size counter. Because there was no preliminary check to ensure that the specified OBU size did not exceed the available data in the buffer, a crafted or maliciously constructed AV1 stream could provide an excessively large OBU size value. This causes the subtraction operation intended to update the remaining-size counter to underflow, resulting in wraparound where the negative result is interpreted as a very large positive integer due to unsigned arithmetic rules common in C programming. Consequently, subsequent iterations of the loop proceed with invalid assumptions about available data length and attempt to dereference memory addresses that lie beyond the end of the allocated packet buffer.
From an operational perspective, this out-of-bounds read poses significant risks depending on how FFmpeg is deployed within a larger system architecture. While immediate exploitation for arbitrary code execution may be difficult due to the nature of a read-only violation, it can lead to information disclosure by leaking sensitive data from adjacent memory regions into the output stream or application logs. Furthermore, such violations often trigger segmentation faults or core dumps in debug builds and undefined behavior in release builds, leading to denial-of-service conditions where media processing pipelines crash unexpectedly. In streaming environments that rely on FFmpeg for real-time transcoding or packetization, this instability can disrupt service availability and degrade the quality of experience for end-users receiving live video feeds.
This vulnerability aligns with CWE-125, which describes out-of-bounds read vulnerabilities resulting from improper boundary checks during memory access operations. It also relates to CWE-190 regarding integer overflow or wraparound issues that lead to subsequent logic errors in pointer arithmetic. In the context of the MITRE ATT&CK framework, this flaw could be leveraged as part of a reconnaissance phase if an attacker uses it to probe for information leakage, although its primary classification remains within application layer vulnerabilities rather than direct attack techniques like privilege escalation or lateral movement unless combined with other exploits.
Mitigation strategies primarily involve updating FFmpeg to versions released after commit 983dae9, where the developers implemented proper bounds checking before performing arithmetic on buffer sizes and pointers. For systems unable to update immediately, input validation at the ingestion layer is recommended to ensure that AV1 streams conform to expected structural constraints regarding OBU sizes relative to packet lengths. Additionally, deploying runtime protection mechanisms such as Address Sanitizer in development environments or using memory-safe wrappers can help detect similar issues early in the software lifecycle. Organizations should also monitor for updates from FFmpeg maintainers and apply security patches promptly to close gaps that could be exploited by attackers crafting malicious media files designed to trigger these specific parsing errors.