CVE-2026-75147 FFmpeg CVE debrief

Who should care

AV1 RTP packet users, FFmpeg developers and maintainers, media processing and streaming service providers, and security teams responsible for vulnerability management and patching. These stakeholders should review the vulnerability details and take necessary actions to verify and apply patches, restrict access to untrusted input packets, and monitor for suspicious activity.

Technical summary

FFmpeg's AV1 RTP packetizer has an out-of-bounds read vulnerability due to improper validation of OBU sizes in the RTPenc_av1.c file. A crafted AV1 input packet can cause the packetizer to dereference a pointer beyond the end of the packet buffer, leading to potential crashes or information disclosure. The vulnerability is caused by the keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data.

Defensive priority

Medium-severity vulnerability in FFmpeg's AV1 RTP packetizer; verify and apply vendor patches.

Recommended defensive actions

• Verify FFmpeg version and apply patches if vulnerable
• Restrict access to untrusted AV1 input packets
• Monitor for suspicious RTP packet activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Out-of-bounds read in FFmpeg's AV1 RTP packetizer due to improper OBU size validation; verify patches exist. The vulnerability is caused by the keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data. A crafted OBU size causes the remaining-size counter to wrap to a positive value, causing the next loop iteration to dereference a pointer beyond the end of the packet buffer. This issue affects AV1 RTP packet users, FFmpeg developers and maintainers, and media processing and streaming service providers. Evidence limits suggest verifying patches exist and reviewing compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.