CVE-2026-75142 Overview
CVE-2026-75142 is a stack buffer overflow vulnerability in FFmpeg's MPEG-PS muxer, located in libavformat/mpegenc.c. The flaw exists in FFmpeg versions prior to commit 9d786e4. When the muxer processes input containing more streams than its fixed-size stack buffer can hold, the buffer overflows. An attacker crafts input with an excessive number of streams to trigger the overflow during MPEG-PS muxing. The issue is categorized under CWE-121: Stack-based Buffer Overflow.
Critical Impact
A crafted input file with an excessive stream count triggers a stack buffer overflow during MPEG-PS muxing, potentially enabling local code execution in the context of the FFmpeg process.
Affected Products
- FFmpeg versions prior to commit 9d786e4b5e9b8482651928574de33772aeee7be1
- Applications that link against vulnerable libavformat builds
- Media processing pipelines invoking the MPEG-PS muxer via mpegenc.c
Discovery Timeline
- 2026-08-19 - CVE-2026-75142 published to the National Vulnerability Database
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-75142
Vulnerability Analysis
The vulnerability resides in the MPEG-Program Stream (MPEG-PS) muxer implementation in libavformat/mpegenc.c. The muxer allocates a fixed-size buffer on the stack to track per-stream state during muxing operations. FFmpeg does not enforce an upper bound on the number of input streams before writing into this buffer.
When input arrives with more streams than the buffer accommodates, writes proceed past the buffer boundary. The overflow corrupts adjacent stack memory, including saved return addresses and frame pointers. On systems without stack canaries or with predictable stack layouts, this creates a path to control-flow hijacking.
The attack vector is local, and successful exploitation requires user interaction, such as opening or processing a crafted media source. Impact spans confidentiality, integrity, and availability of the FFmpeg process. Refer to the VulnCheck advisory for additional context.
Root Cause
The root cause is a missing bounds check on the number of streams before writing per-stream metadata into a fixed-size stack array. The muxer assumes stream counts remain within compile-time limits and does not validate nb_streams against the buffer capacity in mpegenc.c.
Attack Vector
An attacker crafts a container format or muxing job that declares an excessive number of streams. When a victim runs FFmpeg to remux or transcode into MPEG-PS, the muxer iterates over each stream and writes past the stack buffer. Vulnerable code is described in the FFmpeg upstream commit and Pull Request #24087.
The vulnerability manifests during the muxer's stream-initialization path. No verified public exploit code is available at time of publication.
Detection Methods for CVE-2026-75142
Indicators of Compromise
- Unexpected crashes or segmentation faults in ffmpeg or libavformat-based processes during MPEG-PS muxing operations
- Media files or streams declaring abnormally high stream counts targeting the mpeg or vob output formats
- Core dumps referencing mpegenc.c or MPEG-PS muxer functions in the call stack
Detection Strategies
- Inventory FFmpeg installations and shared libraries across endpoints and servers to identify builds preceding commit 9d786e4
- Monitor process behavior for FFmpeg invocations that terminate abnormally when handling untrusted media input
- Inspect media ingestion pipelines for jobs that request MPEG-PS output from adversary-supplied sources
Monitoring Recommendations
- Enable coredump collection on media-processing hosts and route stack traces to a centralized log store for review
- Track command-line invocations of ffmpeg with -f mpeg or -f vob output targets that originate from user-uploaded content
- Correlate FFmpeg crashes with subsequent process creation or unusual child process activity
How to Mitigate CVE-2026-75142
Immediate Actions Required
- Upgrade FFmpeg to a build that includes commit 9d786e4b5e9b8482651928574de33772aeee7be1 or later
- Rebuild any application statically linked against libavformat after applying the upstream fix
- Restrict FFmpeg processing of untrusted media to sandboxed or containerized environments until patched
Patch Information
The upstream fix is available in the FFmpeg commit 9d786e4 and merged via Pull Request #24087. Downstream distributors should backport the patch to supported release branches. Verify installed binaries and shared libraries include the fix before returning production media pipelines to service.
Workarounds
- Disable MPEG-PS output formats (mpeg, vob, dvd) in FFmpeg wrappers processing untrusted input
- Enforce input validation on stream counts before invoking the MPEG-PS muxer, rejecting files above a safe threshold
- Run FFmpeg under a restricted user account with seccomp or AppArmor profiles that limit syscall surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
