CVE-2026-30754

Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in FFmpeg via RTP H.264/HEVC Encoding

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: MITRE

Description

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-30754

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	to 8.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-30754 is a memory corruption vulnerability in FFmpeg versions before 8.1. It occurs in the RTP encoding process, specifically in the nal_send function in libavformat/rtpenc_h264_hevc.c. A negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This can lead to memory corruption and potentially allow code execution.

Detection Guidance

To detect this vulnerability, monitor FFmpeg versions before 8.1 for crashes or memory corruption when processing H.264/HEVC streams via RTP. Use AddressSanitizer to identify negative size parameters passed to memcpy. Test with a crafted input file using: ffmpeg -c copy -f rtp rtp://127.0.0.1:1234 -i input.

Check FFmpeg version with: ffmpeg -version. If using a vulnerable version, update immediately.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code on systems running vulnerable FFmpeg versions. It may lead to crashes, data corruption, or unauthorized access if exploited via a specially crafted input file. Users processing H.264/HEVC streams via RTP are particularly at risk.

Mitigation Strategies

Immediately upgrade FFmpeg to version 8.1 or later to patch the vulnerability. Avoid processing untrusted H.264/HEVC RTP streams until updated. Monitor for unusual memory corruption or crashes in FFmpeg processes.

Hi! I’m here to help you understand CVE-2026-30754. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70