Integer Narrowing Conversion Vulnerability in FFmpeg AV1 RTP Packetizer

CVE-2026-75145

What is CVE-2026-75145?

An integer narrowing conversion flaw exists within the AV1 RTP packetizer of FFmpeg prior to commit b4c199c. This issue arises due to an incorrect casting of the OBU size to long for comparison with the remaining frame size. On 32-bit long target systems, notably 64-bit Windows, large OBU size values may be incorrectly sign-flipped during the conversion, resulting in negative values that erroneously pass subsequent payload size checks. This facilitates the potential for oversized OBU values to compromise memory safety, leading to out-of-bounds accesses when these values are utilized as copy lengths within the processing flow.

References