CVE-2026-75141
Received Received - Intake

Heap Buffer Overflow in FFmpeg HEVC Muxer

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75141
EUVD
EUVD-2026-62578

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ffmpeg ffmpeg *
ffmpeg ffmpeg to acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap buffer overflow in FFmpeg's hvcC box writer. It occurs when processing HEVC video files with more NAL units of a single type than the count field can handle. The overflow happens during muxing, where the count value wraps around, corrupting memory and potentially allowing arbitrary code execution.

Detection Guidance

To detect this vulnerability, check the FFmpeg version on your system. If it is before commit acf5d7c, it is vulnerable. Run: ffmpeg -version. Compare the output commit hash against acf5d7c.

Impact Analysis

An attacker could exploit this by providing a malicious HEVC file to trigger the overflow. This may lead to crashes, data corruption, or arbitrary code execution on systems using vulnerable FFmpeg versions. Local users or those with file access are most at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a technical flaw in FFmpeg's HEVC muxing process that could allow arbitrary code execution or denial of service if exploited. Compliance impacts would depend on how the affected software is used in a system handling regulated data.

Mitigation Strategies

Update FFmpeg to the latest commit or version that includes the fix for the hvcC box writer heap buffer overflow. Avoid processing untrusted HEVC input files until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75141. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart