CVE-2026-75146: FFmpeg Out-of-Bounds Read in DASH Demuxer via dashdec.c
FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpeg (libavformat/dashdec.c)to a version that resolves this vulnerability.Patch 65b0dab
Event History
Frequently Asked Questions
Who is exposed to this issue?
FFmpeg deployments that process live DASH streams from a malicious or misconfigured server are exposed if they are running a version from before commit 65b0dab. The issue is triggered during a live manifest refresh.
What must an attacker control to trigger the flaw?
An attacker needs to serve a live DASH manifest whose startNumber decreases relative to the value in a previously refreshed manifest. No privileges are required, but user interaction is required according to the supplied severity vector.
Are static DASH manifests affected?
The described trigger depends on refreshing a live DASH manifest and observing a lower startNumber than on the prior refresh. The provided information does not identify static manifests as affected.
What remediation is identified?
Update FFmpeg to a version containing commit 65b0dab903e5975e036b30ecc58f5935d4f151e0. If updating cannot happen immediately, avoid processing live DASH streams from untrusted or unreliable servers where possible.