Executive brief
FFmpeg is a widely-used multimedia framework that includes a DASH (Dynamic Adaptive Streaming over HTTP) demuxer for processing video streams. A vulnerability in this demuxer allows an attacker operating a malicious DASH media server to trigger an out-of-bounds memory read by sending a manifest with a decreasing startNumber value. This could cause FFmpeg to crash or potentially leak sensitive memory contents, disrupting video playback services and exposing confidential data.
Technical details
The vulnerability is an out-of-bounds read in libavformat/dashdec.c that occurs when a live DASH manifest is refreshed with a startNumber lower than the previous value. The DASH demuxer's move_segments() function calculates a sequence number (cur_seq_no) by subtracting the old startNumber from the new one; if the new startNumber is lower, this difference becomes negative. The get_current_fragment() function then uses this negative value as an array index into the fragments[] array without checking the lower bound, resulting in out-of-bounds memory access. The attack requires only a network-accessible malicious or misconfigured DASH server; no authentication or user interaction is needed. An attacker can cause memory disclosure or application denial of service. The fix adds a lower-bound check in get_current_fragment() and clamps negative deltas in move_segments(), both merged in commit 65b0dab. The patch is available and scheduled for FFmpeg 9.0.
Affected products
- FFmpeg FFmpeg before commit 65b0dab
Timeline
- 2026-08-19: disclosed: CVE-2026-75146 published
- 2026-08-04: patched: Fix committed as 65b0dab903e5975e036b30ecc58f5935d4f151e0
- 2026-08-11: patched: Patch merged into FFmpeg master branch; scheduled for FFmpeg 9.0