Heap Buffer Overflow in FFmpeg RIST Protocol Reader

CVE-2026-75143

What is CVE-2026-75143?

A heap buffer overflow vulnerability exists in the RIST protocol reader of FFmpeg, specifically in libavformat via librist.c. The function librist_read() fails to properly utilize the size argument, resulting in an overflow when the payload from a remote RIST sender exceeds the buffer's capacity. This situation can be exploited via the async:rist:// URL scheme, allowing an attacker to send a packet with a payload larger than the provided destination buffer, thereby compromising the application's integrity.

References