CVE-2026-75143: FFmpeg Heap Buffer Overflow via RIST Protocol Reader
FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). libristread() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that use FFmpeg's RIST protocol reader through the async:rist:// URL scheme are exposed. The vulnerable behavior is triggered when the async wrapper provides a destination buffer smaller than a received RIST payload.
What must an attacker be able to do to exploit it?
An attacker needs to act as, or control traffic from, a remote RIST sender and send a packet with a payload larger than the caller-provided buffer. No privileges or user interaction are required according to the supplied severity vector.
What should be done if immediate patching is not possible?
Avoid processing untrusted RIST input through the async:rist:// URL scheme until FFmpeg includes commit 1c10bcc2e17255dacb717a25ab3db142ce390602. Restricting access to trusted RIST senders can reduce exposure, since exploitation requires a sender to deliver an oversized payload.