CVE-2026-75145: FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer
FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpencav1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg (libavformat/rtpenc_av1.c)to a version that resolves this vulnerability.Patch b4c199c
Event History
Frequently Asked Questions
Which systems are affected by the narrowing conversion issue?
The issue affects targets where long is 32 bits, including 64-bit Windows. The vulnerable code is the AV1 RTP packetizer in libavformat/rtpenc_av1.c.
What does an attacker need to trigger the out-of-bounds access?
An attacker needs to cause processing of an AV1 OBU with a sufficiently large size value. When that value is narrowed to a 32-bit long, it can become negative, bypass the remaining-frame-size check, and later be used as a copy length.
What should be done to remediate the issue?
Update FFmpeg to a version containing commit b4c199c5906ff53368926c2a5839881f41957e7f. The provided data identifies affected releases only as versions before that commit.