Executive brief
FFmpeg's AV1 RTP packetizer (a component that prepares AV1 video frames for network transmission) contains a flaw where oversized OBU (Open Bitstream Unit) values bypass a critical safety check on 32-bit platforms including 64-bit Windows. An attacker who can provide a malformed AV1 video stream could trigger out-of-bounds memory access, potentially causing a denial of service or worse during media playback or streaming.
Technical details
The vulnerability is an integer narrowing conversion bug (CWE-197) in libavformat/rtpenc_av1.c. The OBU size value is incorrectly cast to a signed long before comparison against the remaining frame size. On targets where long is 32 bits (such as 64-bit Windows using the LLP64 data model), OBU size values in the range 0x80000000–0xfffffffd are sign-flipped to negative values by the cast, allowing them to bypass the payload size safety check. This permits an oversized OBU to proceed to a copy operation where the malformed size is used as a memcpy length, resulting in out-of-bounds memory access. The fix (commit b4c199c) changes the comparison to use unsigned arithmetic (uint32_t) instead of narrowing to long. Exploitation requires network access to supply a malformed AV1 stream; no public proof-of-concept exists.
Affected products
- FFmpeg FFmpeg before commit b4c199c
Timeline
- 2026-08-19: disclosed
- 2026-08-11: patched: commit b4c199c merged to master