Skip to content
OpenAdvisories
Medium · 5.8 CVE-2026-75145 EUVD-2026-62582GHSA-6fh5-pxvv-ccvw

FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer

Published Aug 19, 2026 · Updated Oct 27, 2026 · Assigned by VulnCheck

Description

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length.

Affected products

VendorProductAffectedFixed
FFmpeg FFmpeg — —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ffmpeg 7:9.0.2-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 ffmpeg No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS ffmpeg No fix yet —
Ubuntu Pro 24.04 LTS ffmpeg No fix yet —
Ubuntu Pro 22.04 LTS ffmpeg No fix yet —
Ubuntu Pro 20.04 LTS ffmpeg No fix yet —
Ubuntu Pro 18.04 LTS ffmpeg No fix yet —
Ubuntu Pro 16.04 LTS ffmpeg No fix yet —
Ubuntu Pro 14.04 LTS libav No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed ffmpeg-7 7.1.5-2.1 openSUSE-SU-2026:11665-1
openSUSE Tumbleweed ffmpeg-8 8.1.2-3.1 openSUSE-SU-2026:11682-1
openSUSE Tumbleweed ffmpeg-9 9.0.1-3.1 openSUSE-SU-2026:11659-1

Advisories 4

References