Out-of-bounds memory access via narrowed OBU size
Published Aug 19, 2026 · Updated Aug 19, 2026
Out-of-bounds memory access in FFmpeg before commit b4c199c allows local users to trigger a copy-length overrun via a crafted OBU size. In libavformat/rtpenc_av1.c, ff_rtp_send_av1 casts parsed obu_size to long before comparing it with the remaining frame_size; on targets where long is 32 bits, large values become negative, pass the bounds check, and are then used as the subsequent copy length. Reachability requires FFmpeg to packetize attacker-controlled AV1 data on affected platforms such as 64-bit Windows, and the published record describes memory-safety impact without a public code-execution demonstration.
Summary
What happened
Out-of-bounds memory access in FFmpeg before commit b4c199c allows local users to trigger a copy-length overrun via a crafted OBU size. In libavformat/rtpenc_av1.c, ff_rtp_send_av1 casts parsed obu_size to long before comparing it with the remaining frame_size; on targets where long is 32 bits, large values become negative, pass the bounds check, and are then used as the subsequent copy length. Reachability requires FFmpeg to packetize attacker-controlled AV1 data on affected platforms such as 64-bit Windows, and the published record describes memory-safety impact without a public code-execution demonstration.
The record
- CVE
- CVE-2026-75145
- Published
- Aug 19, 2026
- Updated
- Aug 19, 2026
- Vendor
- FFmpeg
- Product
- FFmpeg
- Classifications
- CWE-681
- Attack vector
- local
- Privileges
- unauthenticated
Timeline
How it unfolded
- Aug 19, 2026CVE publishedPublication date reported by the CVE source.
- Aug 19, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=0 <b4c199c5906ff53368926c2a5839881f41957e7f
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo