Out-of-Bounds Read in FFmpeg AV1 RTP Packetizer

CVE-2026-75147

What is CVE-2026-75147?

A vulnerability exists in FFmpeg where an out-of-bounds read can occur in the AV1 RTP packetizer (libavformat/rtpenc_av1.c) due to the improper handling of encoded header lengths and OBU payload sizes. Specifically, during keyframe detection, the pointer and remaining-size counter are altered without proper size validation, allowing crafted OBU sizes to lead the counter to wrap positively. This can result in dereferencing a pointer beyond the valid area of the packet buffer, ultimately posing a risk when processing AV1 input packets multiplexed to RTP.

References