CVE-2026-75146: FFmpeg Buffer Overflow Vulnerability

CVE-2026-75146 Overview

CVE-2026-75146 is an out-of-bounds read vulnerability [CWE-125] in the FFmpeg Dynamic Adaptive Streaming over HTTP (DASH) demuxer. The flaw resides in libavformat/dashdec.c and affects FFmpeg builds prior to commit 65b0dab. When a live DASH manifest is refreshed with a startNumber lower than the previous value, the current sequence number is driven negative. The fragment retrieval function validates only the upper bound of the fragments array index, permitting a negative index and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger the condition by serving a live manifest with a decreasing startNumber across a manifest refresh.

Critical Impact
A remote DASH server can force FFmpeg-based clients and pipelines to perform out-of-bounds memory reads, potentially disclosing process memory or crashing the decoder.

Affected Products

FFmpeg versions before commit 65b0dab903e5975e036b30ecc58f5935d4f151e0
Applications and services embedding the vulnerable libavformat DASH demuxer
Media pipelines that consume third-party live DASH manifests via FFmpeg

Discovery Timeline

2026-08-19 - CVE-2026-75146 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75146

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the FFmpeg DASH demuxer implemented in libavformat/dashdec.c. FFmpeg tracks the sequence position of the currently requested media fragment relative to the manifest's startNumber. When the client refreshes a live manifest and the server advertises a startNumber lower than the value observed in a prior refresh, the internal calculation of the current sequence index produces a negative result. The demuxer then uses this signed integer directly as an index into the fragments array.

The fragment retrieval routine performs a bounds check only against the upper limit of the array, comparing the index against the number of available fragments. It does not verify that the index is greater than or equal to zero. As a result, a negative index is accepted and the code reads memory that precedes the fragments array in the process address space.

Depending on adjacent heap contents, the read can leak sensitive data through subsequent parsing or logging paths, or lead to a segmentation fault and denial of service.

Root Cause

The root cause is missing lower-bound validation on a signed sequence index used to look up entries in the fragments array. The demuxer trusts server-controlled input (startNumber from the DASH Media Presentation Description) to derive the index without enforcing a non-negative invariant.

Attack Vector

An attacker controls or compromises the DASH origin server, or performs a man-in-the-middle attack against an unauthenticated DASH stream. The attacker serves an initial manifest with a specific startNumber, then serves a refreshed manifest with a decreased startNumber. When the FFmpeg client requests the next fragment, the resulting negative index triggers the out-of-bounds read. User interaction is required in the form of the victim opening or continuing playback of the attacker-controlled DASH URL.

The vulnerability is described in prose only; see the FFmpeg Commit Update and FFmpeg Pull Request #24093 for the corrective patch and technical discussion.

Detection Methods for CVE-2026-75146

Indicators of Compromise

FFmpeg or downstream media application process crashes with SIGSEGV while parsing DASH streams
HTTP responses containing DASH manifests where startNumber decreases across successive refreshes of the same MPD URL
Outbound connections from media processing hosts to untrusted or newly registered DASH origins

Detection Strategies

Inspect DASH manifest traffic and alert when a live MPD refresh returns a startNumber value lower than a previously observed value for the same representation.
Instrument FFmpeg-based workloads with AddressSanitizer (ASan) in test environments to surface out-of-bounds reads originating in dashdec.c.
Correlate process crash telemetry from media services with concurrent DASH manifest fetches to identify triggering URLs.

Monitoring Recommendations

Log manifest refresh cycles including URL, startNumber, and timescale fields for post-incident analysis.
Monitor FFmpeg library versions across servers, transcoders, and endpoint applications through software inventory tooling.
Track egress connections from transcoding and playback infrastructure to identify anomalous DASH origins.

How to Mitigate CVE-2026-75146

Immediate Actions Required

Update FFmpeg to a build that includes commit 65b0dab903e5975e036b30ecc58f5935d4f151e0 or later.
Rebuild and redeploy any application that statically links or bundles the vulnerable libavformat DASH demuxer.
Restrict FFmpeg-based clients and services to trusted DASH origins until patched builds are verified in production.

Patch Information

The fix is available in the upstream FFmpeg repository. Refer to the FFmpeg Commit Update and the associated FFmpeg Pull Request #24093. Additional advisory context is available in the VulnCheck Advisory for FFmpeg. Downstream distributions should pull the patch into their FFmpeg packages and release updated binaries.

Workarounds

Disable the DASH demuxer at build time using --disable-demuxer=dash where DASH support is not required.
Enforce HTTPS with certificate pinning for DASH origins to prevent manifest tampering by network attackers.
Sandbox FFmpeg processes with seccomp, AppArmor, or SELinux profiles that constrain memory access and outbound networking.

bash

# Configuration example: build FFmpeg without the vulnerable DASH demuxer
./configure --disable-demuxer=dash --disable-protocol=dash
make && make install