Executive brief
FFmpeg's AV1 RTP packetizer (used to stream AV1-encoded video over network protocols) contains a buffer overflow vulnerability that can be triggered by a specially crafted video packet. An attacker could crash the media server or potentially execute arbitrary code by sending a malformed AV1 stream to a system using FFmpeg for RTP muxing.
Technical details
An out-of-bounds read vulnerability exists in libavformat/rtpenc_av1.c in the keyframe detection loop. The loop processes AV1 OBU (Open Bitstream Unit) structures without properly validating the OBU size against the remaining packet buffer. A crafted OBU size value (approximately 0x80000010) causes integer wraparound in the remaining-size counter, making it wrap to a positive value. On the next loop iteration, this causes the pointer to dereference memory beyond the packet buffer boundary. The vulnerability is reachable from any AV1 packet muxed to RTP format. The fix, merged in commit 983dae9, bounds the OBU size check against remaining data before advancing the buffer pointer, mirroring the validation in the main packetization loop.
Affected products
- FFmpeg FFmpeg before commit 983dae9
Timeline
- 2026-08-19: disclosed: CVE-2026-75147 published
- 2026-08-11: patched: Fix merged in commit 983dae9c19f46c87d597598c0fd2f2fcee0ad2f8