CVE-2026-75146 FFmpeg CVE debrief

Who should care

Organizations using FFmpeg, particularly those handling media processing or streaming, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating FFmpeg to the latest version, monitoring for suspicious DASH server activity, and implementing compensating controls to detect and prevent out-of-bounds reads. Additionally, organizations should verify their FFmpeg versions and configurations to ensure they are not vulnerable to this issue. Security teams and vulnerability management teams should prioritize patching and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

The DASH demuxer (libavformat/dashdec.c) in FFmpeg before commit 65b0dab contains an out-of-bounds read vulnerability. When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. This issue can be triggered by a malicious or misconfigured DASH server serving a live manifest with a decreasing startNumber across a manifest refresh. The vulnerability can lead to potential out-of-bounds read attacks if not properly patched.

Defensive priority

Organizations using FFmpeg should prioritize patching to prevent potential out-of-bounds read attacks.

Recommended defensive actions

• Apply the patch from https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0
• Review and update FFmpeg to the latest version
• Monitor for suspicious DASH server activity
• Implement compensating controls to detect and prevent out-of-bounds reads
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record indicates an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c) of FFmpeg before commit 65b0dab. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh. The issue arises when a live DASH manifest is refreshed with a startNumber that is lower than the previous value, causing the current sequence number to be driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. Organizations should verify their FFmpeg versions and configurations to ensure they are not vulnerable to this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.