Description
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ffmpeg | 7:8.0.1-2 | — |
| Debian 13 | ffmpeg | 7:7.1.3-0+deb13u1 | — |
| Debian 12 | ffmpeg | 7:5.1.8-0+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | ffmpeg | 7:8.0.1-3ubuntu2+esm5 | USN-8915-1 |
| Ubuntu Pro 24.04 LTS | ffmpeg | 7:6.1.1-3ubuntu5+esm15 | USN-8915-1 |
| Ubuntu Pro 22.04 LTS | ffmpeg | 7:4.4.2-0ubuntu0.22.04.1+esm17 | USN-8915-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | ffmpeg | 7:4.2.7-0ubuntu0.1+esm18 | USN-8915-1 |
| Ubuntu Pro 18.04 LTS | ffmpeg | 7:3.4.11-0ubuntu0.1+esm16 | USN-8915-1 |
| Ubuntu Pro 16.04 LTS | ffmpeg | 7:2.8.17-0ubuntu0.1+esm18 | USN-8915-1 |
| Ubuntu Pro 14.04 LTS | libav | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ffmpeg-7 +1 | 7.1.3-r0 | — |
| Wolfi rolling | ffmpeg-8.0 | 8.0.1-r0 | — |
Advisories 2
- USN-8915-1 ffmpeg vulnerabilities Ubuntu Security Notices (USN) · Oct 13, 2026
- WID-SEC-2026-3280 ffmpeg: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode BSI CERT-Bund (WID) · Oct 12, 2026