CVE-2026-75142: FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c
FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg (libavformat/mpegenc.c MPEG-PS muxer)to a version that resolves this vulnerability.Patch 9d786e4
Event History
Frequently Asked Questions
Which workflows are exposed to this issue?
Workflows using FFmpeg to mux input into MPEG-PS output are exposed if they process an input containing more streams than the muxer's fixed-size stack buffer supports. The issue is in the MPEG-PS muxer component, libavformat/mpegenc.c.
What does an attacker need to trigger the overflow?
An attacker needs to cause FFmpeg to mux a crafted input with an excessive number of streams into MPEG-PS. The supplied vector indicates no privileges are required, but user interaction is required and exploitation is local.
What should be done if an immediate upgrade is not possible?
Avoid muxing untrusted or unusually high-stream-count inputs to MPEG-PS until the fix can be applied. In particular, prevent inputs with excessive stream counts from reaching the MPEG-PS muxing workflow.
How can I determine whether my FFmpeg source includes the fix?
Check whether the source includes commit 9d786e4b5e9b8482651928574de33772aeee7be1. FFmpeg revisions before that commit are affected.