CVE-2026-75141 Overview
CVE-2026-75141 is a heap buffer overflow in the FFmpeg hvcC box writer, affecting versions prior to commit acf5d7c. The flaw occurs when FFmpeg writes a High Efficiency Video Coding (HEVC) configuration record containing more Network Abstraction Layer (NAL) units of a single type than the count field can represent. The NAL unit count field overflows, and subsequent writes exceed the allocated heap buffer during muxing. A crafted HEVC input file triggers the condition when processed by a vulnerable FFmpeg build. The weakness is classified as [CWE-122] Heap-based Buffer Overflow.
Critical Impact
Processing an attacker-supplied HEVC file with a vulnerable FFmpeg build can corrupt heap memory and enable arbitrary code execution in the context of the muxing process.
Affected Products
- FFmpeg versions before commit acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781
- Applications and services that mux HEVC streams using a vulnerable FFmpeg build
- Downstream distributions and container images bundling pre-patch FFmpeg
Discovery Timeline
- 2026-08-19 - CVE-2026-75141 published to the National Vulnerability Database
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75141
Vulnerability Analysis
The defect resides in FFmpeg's MP4/ISOBMFF muxer, specifically the writer that emits the hvcC (HEVC Configuration) box. The hvcC structure groups NAL units into arrays keyed by NAL unit type, and each array carries a numNalus count stored in a fixed-width field. When the muxer accumulates more NAL units of a single type than the count field can represent, the counter wraps. Downstream write logic uses the actual (larger) number of units while the allocation is sized against the truncated count, producing an out-of-bounds heap write. Exploitation requires local processing of a crafted HEVC input, aligning with the vector described in the CVSS v4.0 assessment. Successful exploitation compromises confidentiality, integrity, and availability of the process performing the mux.
Root Cause
The root cause is a numeric truncation on the NAL unit count field within the hvcC writer. FFmpeg does not validate that the number of accumulated NAL units per type fits within the count field before serialization, resulting in the mismatch between the sizing calculation and the write loop.
Attack Vector
An attacker crafts an HEVC stream containing an excessive number of NAL units of a single type and delivers it to a target that muxes the stream with a vulnerable FFmpeg build. Common exposure paths include media conversion pipelines, transcoding backends, and desktop tools that invoke ffmpeg on user-supplied files. User interaction is required to trigger processing.
No verified public exploit is available. See the FFmpeg Commit Log, the FFmpeg Pull Request Discussion, and the VulnCheck Advisory on FFmpeg for technical detail.
Detection Methods for CVE-2026-75141
Indicators of Compromise
- Unexpected crashes, aborts, or heap corruption signatures in processes invoking ffmpeg during HEVC muxing operations.
- Child processes spawned from ffmpeg or wrapper services that do not match normal transcoding workflows.
- HEVC input files that declare or contain an unusually large number of NAL units of a single type per access unit.
Detection Strategies
- Inventory FFmpeg binaries and libraries across endpoints, servers, and container images, and flag versions predating commit acf5d7c.
- Monitor for process termination signals (SIGSEGV, SIGABRT) associated with ffmpeg executions and correlate with recent HEVC file ingestion.
- Apply behavioral rules that flag transcoding processes performing anomalous memory operations or spawning shells.
Monitoring Recommendations
- Log all invocations of ffmpeg with command-line arguments, input file hashes, and exit codes in centralized telemetry.
- Alert on repeated crashes of media processing services handling untrusted uploads.
- Track file provenance for HEVC content entering transcoding pipelines and retain samples that trigger errors for forensic review.
How to Mitigate CVE-2026-75141
Immediate Actions Required
- Update FFmpeg to a build that includes commit acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781 or later.
- Rebuild and redeploy container images, virtual appliances, and bundled software that ship FFmpeg statically or dynamically linked.
- Restrict which users and services can submit HEVC content to muxing workflows until patches are deployed.
Patch Information
The fix is committed upstream at acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781. Consume the patch from the FFmpeg Commit Log or wait for downstream distribution updates that backport the change. Review the associated FFmpeg Pull Request Discussion for validation notes.
Workarounds
- Avoid muxing HEVC streams from untrusted sources with pre-patch FFmpeg builds.
- Run FFmpeg inside a sandbox (for example, seccomp, AppArmor, or a minimal container) to contain the blast radius of a heap corruption.
- Pre-validate incoming HEVC files with a hardened parser and reject inputs whose NAL unit counts per type exceed reasonable bounds.
# Verify the installed FFmpeg build includes the fix commit
ffmpeg -version
git -C /path/to/ffmpeg log --oneline | grep acf5d7c
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
