Executive brief
FFmpeg is a widely-used multimedia framework that processes audio and video streams. A memory corruption bug in the RTP encoding function for H.264/HEVC video streams allows an attacker to trigger a buffer overflow by providing a crafted media file, potentially leading to code execution on systems processing untrusted video content.
Technical details
The vulnerability is a buffer overflow in the nal_send function of libavformat/rtpenc_h264_hevc.c, where a negative size parameter (size=-3) is incorrectly passed to memcpy during RTP transmission of H.264/HEVC streams. The root cause is insufficient validation of size parameters before memory operations. An attacker can exploit this by crafting a malicious input file processed with FFmpeg's RTP output mode (e.g., "ffmpeg -c copy -f rtp rtp://127.0.0.1:1234 -i input"). The vulnerability requires local access to trigger and was detected using AddressSanitizer. A fix was merged upstream in PR #20746, adding proper space checks for nal_length_size in the ff_rtp_send_h264_hevc function.
Affected products
- FFmpeg FFmpeg before 8.1
Timeline
- 2026-09-08: disclosed
- 2025-10-24: other: Fix PR #20746 opened
- 2025-10-30: patched: Fix merged into master