CVE-2026-75144 FFmpeg CVE debrief

Who should care

Users of FFmpeg, particularly those who handle RTP output, should be aware of this vulnerability and take defensive actions. This includes operators of FFmpeg-based systems, platform administrators, vulnerability management teams, and security teams. The vulnerability has a HIGH CVSS severity score of 8.5, indicating a high level of risk. Affected product deployments should be reviewed for exposure, and owners should prioritize patching or mitigating this vulnerability. Compensating controls, such as restricting access to the affected component and monitoring for suspicious RTP output, should be considered while remediation is scheduled and verified. Asset inventory and rollback/change windows should also be reviewed to ensure effective remediation and minimize potential impact. Source tracking and exposure review are also recommended to ensure that all affected systems are identified and remediated. Monitoring and detection capabilities should be reviewed to ensure that potential exploitation can be detected. The goal is to minimize the risk of memory corruption and ensure the integrity of FFmpeg-based systems. Vulnerability management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. In addition, they should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Overall, a comprehensive review of affected systems, defensive actions, and remediation planning is necessary to address this vulnerability effectively. The priority should be on applying the patch from commit 1cdeb3c4e7f1f8566d846b9b451e01c376398818 and restricting access to the affected component. Compensating controls, such as monitoring for suspicious RTP output, should also be implemented while remediation is scheduled and verified. Asset inventory and source tracking are also crucial to ensure that all affected systems are identified

Technical summary

The vulnerability is a heap buffer overflow in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) in FFmpeg before commit 1cdeb3c. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output. This vulnerability can be triggered by supplying a crafted Dirac data unit, which can lead to memory corruption. The affected component is the RTP packetizer, and the vulnerability has a HIGH CVSS severity score of 8.5. Defensive actions should focus on restricting access to the affected component and monitoring for suspicious RTP output.

Defensive priority

High-priority defensive actions are recommended due to the HIGH CVSS severity score of 8.5 for this vulnerability.

Recommended defensive actions

• Apply the patch from commit 1cdeb3c4e7f1f8566d846b9b451e01c376398818
• Restrict access to the affected component
• Monitor for suspicious RTP output
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The vulnerability is a heap buffer overflow in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) in FFmpeg before commit 1cdeb3c. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output. Evidence is based on official CVE Program and NVD records, as well as source references from [email protected].

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.