CVE-2026-75144: FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer
FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpencvc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg (libavformat/rtpenc_vc2hq.c)to a version that resolves this vulnerability.Patch 1cdeb3c
Event History
Frequently Asked Questions
Which FFmpeg workflows are exposed to this issue?
The vulnerable code is the VC-2/Dirac RTP packetizer in libavformat/rtpenc_vc2hq.c. Exposure requires processing Dirac data units for RTP output; the provided information does not establish that unrelated FFmpeg workflows are affected.
What does an attacker need to provide to trigger the overflow?
An attacker needs to supply a crafted Dirac data unit that is packetized for RTP output. The input-derived data unit or fragment size can exceed the fixed-size destination buffer because it is copied without an upper-bound check.
What is the available remediation information?
The issue affects FFmpeg before commit 1cdeb3c. Updating to a build that includes commit 1cdeb3c4e7f1f8566d846b9b451e01c376398818 addresses the missing upper-bound check.