Executive brief
FFmpeg is a multimedia framework used to encode, decode, and process audio and video files. The RIST protocol reader in FFmpeg contains a heap buffer overflow vulnerability that allows a remote attacker to crash the application or potentially execute arbitrary code by sending a specially crafted packet over RIST. This affects applications using FFmpeg to receive or stream video/audio content via RIST.
Technical details
The vulnerability is a heap buffer overflow in the librist_read() function within libavformat/librist.c. The vulnerable code ignored the caller-provided buffer size argument and instead copied the full received payload length into the destination buffer, causing an overflow when the payload exceeded the buffer capacity. This is triggered via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload size. A remote RIST sender can exploit this by transmitting a packet with a payload larger than the caller's buffer, leading to out-of-bounds memory write. The fix clamps the memcpy() operation to the smaller of the payload length and caller-provided buffer size, respecting the URLProtocol.url_read contract.
Affected products
- FFmpeg FFmpeg before commit 1c10bcc
Timeline
- 2026-08-19: disclosed: CVE-2026-75143 published
- 2026-08-04: patched: Patch committed as 1c10bcc
- 2026-08-11: patched: Fix merged into FFmpeg master, targeted for FFmpeg 9.0 release