CVE-2026-75143: FFmpeg Buffer Overflow Vulnerability

CVE-2026-75143 Overview

CVE-2026-75143 is a heap buffer overflow in FFmpeg's RIST (Reliable Internet Stream Transport) protocol reader located in libavformat/librist.c. The librist_read() function ignores its size argument and copies the full received payload length into the caller-provided destination buffer. When the payload exceeds the destination buffer size, adjacent heap memory is corrupted. The flaw is reachable through the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the incoming payload. A remote RIST sender can trigger the overflow by transmitting a packet whose payload exceeds the caller buffer size.

Critical Impact
A remote attacker controlling a RIST sender can corrupt heap memory in FFmpeg processes consuming async:rist:// streams, enabling potential remote code execution.

Affected Products

FFmpeg versions before commit 1c10bcc2e17255dacb717a25ab3db142ce390602
Applications and services embedding vulnerable libavformat with librist support
Streaming and transcoding pipelines that ingest async:rist:// URLs

Discovery Timeline

2026-08-19 - CVE-2026-75143 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75143

Vulnerability Analysis

The vulnerability [CWE-122] resides in the RIST protocol reader implementation within libavformat/librist.c. FFmpeg's librist_read() function accepts a destination buffer and its size from the caller. Instead of honoring the provided size, the function copies the entire received payload length returned by the underlying librist library into the destination buffer. When callers supply a buffer smaller than the incoming payload, the copy writes past the allocated region, producing a classic heap buffer overflow.

The issue becomes remotely reachable through FFmpeg's async I/O wrapper. When a user opens a URL with the async:rist:// scheme, the async layer allocates a fixed-size buffer that can be smaller than the RIST payload. Because librist_read() disregards the caller-supplied size, a remote RIST sender can shape a packet whose payload length exceeds the async buffer and force out-of-bounds writes on the heap.

Root Cause

The root cause is missing bounds enforcement in librist_read(). The function treats the library-returned payload length as the copy size instead of clamping it against the caller's buffer size. This violates the contract shared by every read()-style callback in libavformat.

Attack Vector

Exploitation requires the victim process to open an attacker-influenced async:rist:// URL, or to connect to a RIST endpoint controlled by the attacker. Once the session is established, the attacker sends a RIST packet whose payload exceeds the async wrapper's buffer, overflowing the heap. Consult the VulnCheck Advisory on FFmpeg and the FFmpeg Commit Update for technical details.

Detection Methods for CVE-2026-75143

Indicators of Compromise

Unexpected crashes, SIGSEGV, or heap corruption reports in FFmpeg or applications linking libavformat with RIST support
Process logs referencing async:rist:// URLs from untrusted or unexpected peers
Inbound RIST/UDP traffic to media hosts from unrecognized sources on RIST ports

Detection Strategies

Inventory hosts running FFmpeg builds compiled with --enable-librist and compare their commit hash against 1c10bcc2e17255dacb717a25ab3db142ce390602
Inspect command lines, configuration files, and playlists for use of the async:rist:// URL scheme
Correlate FFmpeg crash telemetry with concurrent inbound RIST session initiations

Monitoring Recommendations

Alert on repeated crashes of media processing services that link libavformat
Monitor egress and ingress on RIST UDP ports and log RIST peers connecting to internal FFmpeg workers
Enable core dump collection and heap allocator diagnostics for streaming workloads to catch overflow signatures

How to Mitigate CVE-2026-75143

Immediate Actions Required

Update FFmpeg to a build that includes commit 1c10bcc2e17255dacb717a25ab3db142ce390602 or later
Audit all applications that embed libavformat with librist support and rebuild against the patched source
Restrict RIST ingest to authenticated, allow-listed peers at the network boundary

Patch Information

The upstream fix is available in the FFmpeg Commit Update and tracked in the corresponding FFmpeg Pull Request. The patch clamps the copy length in librist_read() to the caller-supplied buffer size, preventing the out-of-bounds write.

Workarounds

Disable RIST support by rebuilding FFmpeg without --enable-librist when the protocol is not required
Avoid opening async:rist:// URLs and use direct rist:// handling only with sufficiently sized buffers
Sandbox media workers with seccomp, AppArmor, or containers to limit the impact of heap corruption
Terminate untrusted RIST feeds at a hardened gateway or proxy before they reach FFmpeg

bash

# Configuration example: build FFmpeg without librist to remove the attack surface
./configure --disable-librist
make -j"$(nproc)"
make install