Heap Buffer Overflow in FFmpeg VC-2/Dirac RTP Packetizer
CVE-2026-75144

8.5HIGH

Key Information:

Vendor

Ffmpeg

Status
Ffmpeg
Vendor
CVE Published:
19 August 2026

What is CVE-2026-75144?

A heap buffer overflow vulnerability exists in the VC-2/Dirac RTP packetizer of FFmpeg, allowing attackers to exploit this flaw by supplying specially crafted Dirac data units. The vulnerability arises from a failure to validate the size of input-derived data units when copied into a fixed-size buffer. This oversight can lead to memory corruption, potentially allowing a malicious actor to manipulate the execution flow and perform unauthorized actions. It's essential for users of FFmpeg to review their usage and ensure they are running patched versions to mitigate this risk.

Affected Version(s)

FFmpeg 0 < 1cdeb3c4e7f1f8566d846b9b451e01c376398818

References

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091
issue-tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1...
patch
https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-o...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
.