CVE-2026-75147

HIGH 7.1

FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data. A crafted OBU size causes the remaining-size counter to wrap to a positive value, causing the next loop iteration to dereference a pointer beyond the end of the packet buffer. A crafted AV1 input packet muxed to RTP triggers the out-of-bounds read.

CWE	CWE-125
Vendor	ffmpeg
Product	ffmpeg
Published	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for ffmpeg ffmpeg

Be the first to know when new high vulnerabilities affecting ffmpeg ffmpeg are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Affected Versions

FFmpeg / FFmpeg

0 < 983dae9c19f46c87d597598c0fd2f2fcee0ad2f8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24096 code.ffmpeg.org: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/983dae9c19f46c87d597598c0fd2f2fcee0ad2f8 vulncheck.com: https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-av1-rtp-packetizer-via-rtpenc-av1-c

Credits

Joshua Rogers (AISLE Research)