CVE-2026-75146
Received Received - Intake

Out-of-Bounds Read in FFmpeg DASH Demuxer

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75146
EUVD
EUVD-2026-62583

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ffmpeg ffmpeg *
ffmpeg ffmpeg to 65b0dab (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read in FFmpeg's DASH demuxer. It occurs when a live DASH manifest is refreshed with a startNumber lower than the previous value, causing the sequence number to become negative. The fragment retrieval function only checks the upper bound, allowing a negative index to access memory outside the fragments array.

Detection Guidance

To detect this vulnerability, monitor FFmpeg versions before commit 65b0dab903e5975e036b30ecc58f5935d4f151e0. Check if your system uses FFmpeg for DASH streaming and verify manifest handling. No specific commands are provided in the context.

Impact Analysis

A malicious or misconfigured DASH server could exploit this to cause crashes, data corruption, or potentially execute arbitrary code on systems processing the DASH streams. Users processing untrusted DASH content are most at risk.

Mitigation Strategies

Update FFmpeg to commit 65b0dab903e5975e036b30ecc58f5935d4f151e0 or later. Disable live DASH streaming if not required. Monitor DASH manifest startNumber values to prevent negative sequence numbers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart