Executive brief
FFmpeg is a widely used multimedia framework that handles video and audio encoding, decoding, and streaming across numerous applications. A heap buffer overflow in its VC-2/Dirac RTP packetizer allows attackers to trigger memory corruption by providing specially crafted Dirac video data, potentially leading to crashes, information disclosure, or remote code execution in services that process untrusted video streams.
Technical details
The vulnerability is a heap buffer overflow in libavformat/rtpenc_vc2hq.c's send_packet() function. The packetizer copies an input-derived data unit or fragment size into a fixed-size RTP payload buffer (rtp_ctx->buf) without validating that the size fits within the buffer, allowing overflow when processing crafted Dirac video units even at default packet sizes. The vulnerable code path is reachable when packetizing VC-2/Dirac video for RTP output. The fix (commit 1cdeb3c) adds a bounds check to reject data units larger than max_payload_size minus header overhead, preventing the overflow. No special authentication or user interaction is required—any service accepting untrusted Dirac video streams is at risk.
Affected products
- FFmpeg FFmpeg before commit 1cdeb3c
Timeline
- 2026-08-19: disclosed: CVE-2026-75144 published
- 2026-08-11: patched: Fix merged in commit 1cdeb3c and PR #24091