CVE-2026-75144: FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer
FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpencvc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg (libavformat/rtpenc_vc2hq.c)to a version that resolves this vulnerability.Patch commit 1cdeb3c - Compensating control
If FFmpeg is used to packetize untrusted VC-2/Dirac RTP input, restrict access to the RTP packetizer (e.g., limit who can send Dirac data units) to reduce exposure to crafted inputs that trigger the heap buffer overflow.
Event History
Frequently Asked Questions
Which FFmpeg workflows are exposed to this issue?
The vulnerable code is the VC-2/Dirac RTP packetizer in libavformat/rtpenc_vc2hq.c. Exposure requires processing Dirac data units for RTP output; the provided information does not establish that unrelated FFmpeg workflows are affected.
What does an attacker need to provide to trigger the overflow?
An attacker needs to supply a crafted Dirac data unit that is packetized for RTP output. The input-derived data unit or fragment size can exceed the fixed-size destination buffer because it is copied without an upper-bound check.
What is the available remediation information?
The issue affects FFmpeg before commit 1cdeb3c. Updating to a build that includes commit 1cdeb3c4e7f1f8566d846b9b451e01c376398818 addresses the missing upper-bound check.