CVE-2026-75144
Received Received - Intake

Heap Buffer Overflow in FFmpeg VC-2/Dirac RTP Packetizer

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75144
EUVD
EUVD-2026-62581

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ffmpeg ffmpeg *
ffmpeg ffmpeg to 1cdeb3c (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap buffer overflow vulnerability in FFmpeg's VC-2/Dirac RTP packetizer. It occurs when the software processes crafted Dirac data units without checking the size of input-derived data. This causes memory corruption by writing beyond the intended buffer limits during RTP output generation.

Detection Guidance

This vulnerability is specific to FFmpeg versions before commit 1cdeb3c4e7f1f8566d846b9b451e01c376398818. To detect it, check your FFmpeg version with 'ffmpeg -version'. If it is older than the commit hash, the system is vulnerable. No direct network detection commands are provided in the context.

Impact Analysis

An attacker could exploit this to crash applications using FFmpeg, execute arbitrary code, or gain elevated privileges on systems processing malicious Dirac data. Local users or those with network access to FFmpeg services may be affected depending on the application's use case.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling memory corruption through heap buffer overflows. Such flaws may lead to unauthorized data access, modification, or denial of service, which are critical risks under these regulations. However, specific compliance impacts depend on system configuration and deployment context.

Mitigation Strategies

Update FFmpeg to the latest commit or version that includes the fix for CVE-2026-75144. Avoid processing untrusted Dirac data units or RTP packets until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart