CVE-2026-75147
Received Received - Intake

Out-of-Bounds Read in FFmpeg AV1 RTP Packetizer

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data. A crafted OBU size causes the remaining-size counter to wrap to a positive value, causing the next loop iteration to dereference a pointer beyond the end of the packet buffer. A crafted AV1 input packet muxed to RTP triggers the out-of-bounds read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-75147
EUVD
EUVD-2026-62584

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ffmpeg ffmpeg *
ffmpeg ffmpeg to 983dae9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read in FFmpeg's AV1 RTP packetizer. The issue occurs in a loop that searches for a sequence header OBU in keyframe detection. The loop incorrectly advances its pointer and size counter without validating the OBU size against remaining data. A crafted OBU size can cause the counter to wrap to a positive value, leading to a pointer dereference beyond the packet buffer's end.

Detection Guidance

To detect this vulnerability, inspect FFmpeg versions before commit 983dae9. Check for AV1 RTP packetizer usage in logs or network traffic analysis tools. Monitor for crashes or memory corruption when processing AV1 RTP packets.

Impact Analysis

An attacker could exploit this to read memory outside the intended buffer by sending a specially crafted AV1 input packet muxed to RTP. This may lead to information disclosure or crashes in applications using FFmpeg for AV1 RTP processing.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory access. An out-of-bounds read may expose sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements if exploited.

Mitigation Strategies

Update FFmpeg to commit 983dae9 or later. Disable AV1 RTP packetizer if not required. Filter or block malformed AV1 RTP packets at the network perimeter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75147. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart