CVE-2026-75143: FFmpeg Heap Buffer Overflow via RIST Protocol Reader
FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). libristread() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg libavformat/librist.c (RIST protocol reader)to a version that resolves this vulnerability.Fixed in 1c10bcc - Compensating control
Do not enable or use the async:rist:// URL scheme for remote RIST senders; restrict RIST reader access so remote payloads cannot be fed to FFmpeg via async:rist://.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that use FFmpeg's RIST protocol reader through the async:rist:// URL scheme are exposed. The vulnerable behavior is triggered when the async wrapper provides a destination buffer smaller than a received RIST payload.
What must an attacker be able to do to exploit it?
An attacker needs to act as, or control traffic from, a remote RIST sender and send a packet with a payload larger than the caller-provided buffer. No privileges or user interaction are required according to the supplied severity vector.
What should be done if immediate patching is not possible?
Avoid processing untrusted RIST input through the async:rist:// URL scheme until FFmpeg includes commit 1c10bcc2e17255dacb717a25ab3db142ce390602. Restricting access to trusted RIST senders can reduce exposure, since exploitation requires a sender to deliver an oversized payload.