CVE-2026-75141: FFmpeg Heap Buffer Overflow in hvcC Box Writer via HEVC Muxing
FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpegto a version that resolves this vulnerability.Patch acf5d7c
Event History
Frequently Asked Questions
Which FFmpeg workflows are exposed to this issue?
The vulnerable path is reached when FFmpeg muxes HEVC content and writes an hvcC (HEVC configuration) box. Processing HEVC without performing this muxing operation is not identified as affected by the provided data.
What is required to trigger the overflow?
An attacker needs a crafted HEVC input containing more NAL units of one type than the hvcC count field can represent. The overflow occurs during muxing when FFmpeg writes the HEVC configuration record.
How can I determine whether my FFmpeg build is affected?
Builds made before commit acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781 are affected. Verify whether that commit, or an equivalent downstream fix, is present in the source revision used to build your FFmpeg package.