CVE-2026-75145
Received Received - Intake

Integer Overflow in FFmpeg AV1 RTP Packetizer

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75145
EUVD
EUVD-2026-62582

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ffmpeg ffmpeg *
ffmpeg ffmpeg to b4c199c (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-681 When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FFmpeg involves an incorrect integer narrowing conversion in the AV1 RTP packetizer. When the OBU size is cast to a 32-bit long on platforms like 64-bit Windows, large values are sign-flipped to negative. This bypasses size checks, allowing oversized OBUs to evade safety bounds and cause out-of-bounds memory access during copying.

Detection Guidance

Detecting this vulnerability requires checking the FFmpeg version and verifying if the system uses a 32-bit long type. Commands include: 'ffmpeg -version' to check the version, and inspecting the source code for the AV1 RTP packetizer in libavformat/rtpenc_av1.c for the narrowing conversion issue.

Impact Analysis

The vulnerability may lead to crashes, data corruption, or arbitrary code execution if exploited. Attackers could trigger memory corruption by sending specially crafted AV1 RTP packets, potentially compromising the system running vulnerable FFmpeg versions.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling out-of-bounds memory access, which may lead to data corruption or unauthorized memory exposure. Such issues could compromise data integrity and confidentiality, key requirements under these regulations.

Mitigation Strategies

Immediate mitigation involves updating FFmpeg to commit b4c199c or later. If updating is not possible, avoid processing AV1 RTP packets from untrusted sources until patched. Monitor for signs of out-of-bounds memory access in FFmpeg processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75145. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart