CVE-2026-75145: FFmpeg Buffer Overflow Vulnerability

CVE-2026-75145 Overview

CVE-2026-75145 affects FFmpeg versions prior to commit b4c199c. The vulnerability resides in the AV1 Real-time Transport Protocol (RTP) packetizer implemented in libavformat/rtpenc_av1.c. An incorrect integer narrowing conversion [CWE-681] casts the Open Bitstream Unit (OBU) size to long before comparing it against the remaining frame size. On platforms where long is 32 bits, including 64-bit Windows, large OBU size values are sign-flipped by the narrowing cast. The resulting negative value bypasses the payload size check. An oversized OBU value is then used as a copy length, producing out-of-bounds memory access during RTP packetization.

Critical Impact
An oversized OBU can bypass the payload size boundary check on 64-bit Windows and other LLP64 platforms, leading to out-of-bounds memory access when FFmpeg packetizes AV1 media over RTP.

Affected Products

FFmpeg versions before commit b4c199c5906ff53368926c2a5839881f41957e7f
64-bit Windows builds of FFmpeg (LLP64, where long is 32 bits)
Any FFmpeg-based application using the AV1 RTP packetizer (libavformat/rtpenc_av1.c)

Discovery Timeline

2026-08-19 - CVE-2026-75145 published to the National Vulnerability Database (NVD)
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75145

Vulnerability Analysis

The defect is a numeric truncation error [CWE-681] in the AV1 RTP packetizer. During packetization, FFmpeg reads an OBU size value from the input stream and compares it against the number of bytes remaining in the frame buffer. Before the comparison, the OBU size is cast to long. On LLP64 platforms such as 64-bit Windows, long is 32 bits while pointer-sized arithmetic uses 64 bits. Values with the high bit of the 32-bit representation set become negative after the cast. The signed comparison against the remaining size then evaluates as safe, even though the actual OBU size exceeds the buffer. The same oversized value is later consumed as a copy length, driving the memcpy-style operation past the end of the allocated buffer.

Root Cause

The root cause is an unsafe type conversion in libavformat/rtpenc_av1.c. The code casts an untrusted, wide integer to a narrower signed long before performing a bounds check. The narrowing conversion drops upper bits and reinterprets the sign, invalidating the comparison. Fixed-width integer types and unsigned comparisons would have preserved the original magnitude and prevented the sign flip.

Attack Vector

Exploitation requires local access and user interaction. An attacker crafts an AV1 bitstream containing an OBU whose declared size exceeds INT32_MAX but is smaller than the true frame buffer. When a victim processes the media with FFmpeg configured to packetize AV1 over RTP on an affected platform, the packetizer accepts the oversized OBU and performs an out-of-bounds copy. The vulnerability was addressed in FFmpeg commit b4c199c5906ff53368926c2a5839881f41957e7f. See the FFmpeg Commit Update and FFmpeg Pull Request 24090 for the patch details.

Detection Methods for CVE-2026-75145

Indicators of Compromise

Unexpected FFmpeg process crashes or access violations on 64-bit Windows hosts during RTP streaming of AV1 media
AV1 media files or streams containing OBU size fields greater than 0x7FFFFFFF
Abnormal memory read patterns from FFmpeg processes handling untrusted AV1 input

Detection Strategies

Inventory endpoints and servers running FFmpeg and identify builds compiled before commit b4c199c
Inspect application dependencies for bundled FFmpeg libraries used in media pipelines, WebRTC gateways, and streaming servers
Correlate FFmpeg crash telemetry with RTP-related command-line arguments such as -f rtp and AV1 codec selection

Monitoring Recommendations

Log and alert on FFmpeg process terminations with access violation exit codes on Windows hosts
Monitor endpoints for execution of FFmpeg binaries invoked against untrusted media sources
Track file integrity of FFmpeg binaries and dynamic libraries to confirm patched versions are deployed

How to Mitigate CVE-2026-75145

Immediate Actions Required

Update FFmpeg to a build that includes commit b4c199c5906ff53368926c2a5839881f41957e7f
Prioritize patching 64-bit Windows systems and any LLP64 platform where FFmpeg processes AV1 RTP streams
Rebuild and redistribute internal applications that statically link or bundle affected FFmpeg libraries

Patch Information

The upstream fix is available in the FFmpeg Commit Update and merged via FFmpeg Pull Request 24090. Additional analysis is available in the VulnCheck Security Advisory. Downstream distributions and vendors that package FFmpeg should be tracked for updated releases.

Workarounds

Disable the AV1 RTP packetizer path in workflows that do not require AV1 over RTP
Restrict FFmpeg processing to trusted media sources until patched builds are deployed
Run FFmpeg in sandboxed or least-privilege contexts to limit impact of out-of-bounds memory access

bash

# Verify the installed FFmpeg version includes the fix
ffmpeg -version

# Rebuild from source at or after the patched commit
git clone https://code.ffmpeg.org/FFmpeg/FFmpeg.git
cd FFmpeg
git checkout b4c199c5906ff53368926c2a5839881f41957e7f
./configure && make