FFmpeg: Seven Vulnerabilities Including Critical Heap Overflow Disclosed Together
Key findings • Seven vulnerabilities disclosed in FFmpeg on August 19, 2026, ranging from Medium to Critical severity. • Multiple vulnerabilities involve buffer overflows and out-of-bounds re…
Key findings
- Seven vulnerabilities disclosed in FFmpeg on August 19, 2026, ranging from Medium to Critical severity.
- Multiple vulnerabilities involve buffer overflows and out-of-bounds reads in components like RTP packetizers, demuxers, and muxers.
- CVE-2026-75143, a Critical RIST protocol reader flaw, allows memory corruption by ignoring payload size limits.
- All disclosed vulnerabilities have been patched, with specific commit details provided for each fix.
- Users are urged to update FFmpeg to the latest patched versions to address these security risks.
On August 19, 2026, a batch of seven vulnerabilities was disclosed in FFmpeg, a widely used open-source multimedia framework. The vulnerabilities, ranging in severity from Medium to Critical, were all patched on the same day, indicating a coordinated disclosure event. These flaws primarily involve buffer overflows and out-of-bounds reads within various FFmpeg components, including RTP packetizers, demuxers, and muxers.
Several vulnerabilities stem from improper handling of data sizes and stream counts, leading to memory corruption. CVE-2026-75147 and CVE-2026-75145, both in the AV1 RTP packetizer, involve out-of-bounds reads and incorrect integer conversions, respectively. The DASH demuxer is affected by CVE-2026-75146, which can lead to an out-of-bounds read due to an improperly handled negative sequence number.
Heap buffer overflows are a recurring theme, notably in CVE-2026-75144 (VC-2/Dirac RTP packetizer), CVE-2026-75143 (RIST protocol reader), and CVE-2026-75141 (hvcC box writer for HEVC). These flaws can be triggered by crafted input files or data streams, allowing attackers to corrupt memory. Additionally, CVE-2026-75142 presents a stack buffer overflow in the MPEG-PS muxer when handling an excessive number of streams.
The most critical vulnerability, CVE-2026-75143, with a CVSSv3 score of 9.8, is a heap buffer overflow in the RIST protocol reader. This flaw occurs because the reader ignores its size argument and copies the full received payload into a destination buffer, leading to an overflow if the payload exceeds the buffer's capacity.
All seven vulnerabilities were addressed through code commits, with specific commit hashes provided for each fix. Users are advised to update to the patched versions of FFmpeg to mitigate these risks. The coordinated disclosure of these vulnerabilities highlights the importance of timely patching for critical multimedia processing software.