Out-of-Bounds Read in FFmpeg DASH Demuxer

CVE-2026-75146

What is CVE-2026-75146?

An out-of-bounds read vulnerability exists in the FFmpeg DASH demuxer prior to commit 65b0dab. This issue arises when a live DASH manifest is refreshed with a startNumber that is lower than the previous value, causing the current sequence number to become negative. The flaw lies in the fragment retrieval function, which only checks the upper bound before indexing the fragments array. This oversight allows a negative index to be accessed, posing a risk for out-of-bounds reads. A malicious or misconfigured DASH server can exploit this vulnerability by serving a crafted live manifest containing a decreasing startNumber during a manifest refresh.

References