CVE-2026-30754: FFmpeg FFmpeg vulnerability
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nalsend function in libavformat/rtpench264hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
Affected Software
Event History
Frequently Asked Questions
Which FFmpeg deployments are exposed?
FFmpeg versions before 8.1 are affected when they transmit H.264 or HEVC streams over RTP. The vulnerable code is in the RTP encoding path, so deployments that do not use RTP output for those codecs are not described as affected by this issue.
What must an attacker provide to trigger the flaw?
The issue is triggered through a crafted input file during RTP transmission of H.264 or HEVC streams. The crafted input causes the nal_send function to pass a negative size value, reported as -3, to memcpy.
What is the immediate mitigation if upgrading is not possible?
Avoid processing untrusted H.264 or HEVC input files through FFmpeg workflows that encode or transmit those streams via RTP. Upgrade to FFmpeg 8.1 or later when possible.