CVE-2026-75144: FFmpeg Buffer Overflow Vulnerability

CVE-2026-75144 Overview

CVE-2026-75144 is a heap buffer overflow in FFmpeg's VC-2/Dirac RTP packetizer, located in libavformat/rtpenc_vc2hq.c. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without validating an upper bound. Attackers can trigger memory corruption by supplying a crafted Dirac data unit that FFmpeg then packetizes for RTP output. The flaw is classified under CWE-122: Heap-based Buffer Overflow and was fixed in FFmpeg commit 1cdeb3c.

Critical Impact
A crafted Dirac data unit can corrupt heap memory during RTP packetization, enabling denial of service and potential arbitrary code execution in processes that use FFmpeg for VC-2/Dirac RTP streaming.

Affected Products

FFmpeg versions prior to commit 1cdeb3c4e7f1f8566d846b9b451e01c376398818
Applications and services that link libavformat and expose the VC-2/Dirac RTP packetizer
Downstream distributions bundling vulnerable FFmpeg builds

Discovery Timeline

2026-08-19 - CVE-2026-75144 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75144

Vulnerability Analysis

The VC-2/Dirac RTP packetizer in libavformat/rtpenc_vc2hq.c prepares Dirac data units for transport over RTP. During this process, the code reads a size value derived from the input stream and copies the corresponding data unit or fragment into a fixed-size heap buffer. The routine performs no upper bound check against the destination buffer capacity before the copy. When the attacker-supplied size exceeds that capacity, the packetizer writes past the allocated region and corrupts adjacent heap memory.

Because the size originates from the input rather than a validated internal constant, an attacker who controls the Dirac input can deterministically choose the overflow length. Exploitation requires local access and user interaction, but no privileges. Depending on heap layout, the primitive can be leveraged for process crashes or arbitrary code execution in the context of the process invoking FFmpeg.

Root Cause

The root cause is missing input validation before a memory copy. The packetizer trusts an input-derived length field and uses it to size a copy into a fixed-size buffer. No comparison is made between the source length and the destination capacity, so any oversized data unit produces an out-of-bounds heap write [CWE-122].

Attack Vector

An attacker crafts a malicious Dirac stream or data unit and delivers it to a target using FFmpeg to packetize VC-2/Dirac content for RTP output. Delivery vectors include media files opened by a user, streams pulled by a transcoding service, or content pushed to workflows that invoke libavformat for RTP egress. On processing, the packetizer overflows its heap buffer during RTP fragmentation. See the VulnCheck Advisory on FFmpeg for additional detail.

No verified exploit code is publicly available. See the FFmpeg Commit Details for the corrective patch.

Detection Methods for CVE-2026-75144

Indicators of Compromise

Unexpected crashes, SIGABRT, or SIGSEGV in processes linking libavformat, especially during RTP output workflows involving VC-2 or Dirac codecs.
Heap corruption reports from AddressSanitizer, glibc malloc checks, or Windows heap diagnostics referencing frames inside rtpenc_vc2hq.c.
Media assets containing anomalously large Dirac data unit size fields relative to actual payload length.

Detection Strategies

Inventory FFmpeg builds and library versions across endpoints and media pipelines, flagging any build prior to commit 1cdeb3c.
Instrument media processing services with sanitizer-enabled builds in test environments to catch out-of-bounds writes originating in the VC-2/Dirac packetizer.
Alert on process termination and core dumps in transcoding, streaming, and RTP gateway services.

Monitoring Recommendations

Monitor crash telemetry for RTP-emitting services and correlate with ingestion of Dirac or VC-2 content.
Log FFmpeg command-line invocations and codec parameters to identify unexpected VC-2/Dirac RTP muxing activity.
Track file provenance for media assets processed by automated pipelines to establish source accountability.

How to Mitigate CVE-2026-75144

Immediate Actions Required

Update FFmpeg to a build that includes commit 1cdeb3c4e7f1f8566d846b9b451e01c376398818 or later.
Rebuild and redeploy any applications that statically link vulnerable versions of libavformat.
Restrict processing of untrusted Dirac or VC-2 content until patched binaries are in place.

Patch Information

The fix is available in the upstream FFmpeg repository via commit 1cdeb3c and the associated FFmpeg Pull Request #24091. Apply distribution updates as soon as vendor packages incorporate this commit, or rebuild from source using the patched tree referenced in the FFmpeg Commit Details.

Workarounds

Disable the VC-2/Dirac RTP output path in workflows that do not require it, avoiding the vc2 or dirac payload in RTP muxer configurations.
Sandbox FFmpeg execution using seccomp, containers, or dedicated low-privilege service accounts to limit blast radius.
Validate or reject untrusted media inputs at ingest, filtering out Dirac data units with anomalous size fields.

bash

# Configuration example: verify installed FFmpeg includes the fix commit
ffmpeg -version
git -C /path/to/ffmpeg log --oneline | grep 1cdeb3c