Executive brief
FFmpeg is a widely-used multimedia framework that processes video and audio files. When remuxing HEVC (H.265) video files with certain crafted configurations, an attacker can trigger a heap buffer overflow during file processing. This could lead to denial of service (application crash) or potentially allow arbitrary code execution on systems processing untrusted video files.
Technical details
The vulnerability is a heap buffer overflow in FFmpeg's HEVC configuration record (hvcC box) writer. The root cause is an integer overflow in the NAL unit count field, which is a 16-bit unsigned integer (uint16_t). When a crafted HEVC file declares more than 65,535 NAL units of a single type, the count wraps to 0, causing the code to write to an invalid memory location (nal[-1]). The vulnerability is reachable when remuxing a crafted file with the `-c copy` option, requiring no authentication but user action to process the malicious file. The fix (commit acf5d7c) adds validation to reject hvcC NAL arrays before the count can overflow.
Affected products
- FFmpeg FFmpeg before commit acf5d7c
Timeline
- 2026-08-19: disclosed
- 2026-08-11: patched: Fix merged in commit acf5d7cdc1 to FFmpeg master branch