CVE-2026-75143

🗓️ 19 Aug 2026 16:26:12Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 83 Views🌐 WEB

FFmpeg before 1c10bcc has a heap buffer overflow in librist_read() that ignores its size argument, allowing remote RIST senders to overflow the caller buffer and crash or execute code.

Reporter	Title	Published	Views	Family All 36
Circl	CVE-2026-75143	19 Aug 202618:01	–	circl
Cvelist	CVE-2026-75143 FFmpeg Heap Buffer Overflow via RIST Protocol Reader	19 Aug 202616:26	–	cvelist
Debian CVE	CVE-2026-75143	19 Aug 202616:26	–	debiancve
EUVD	EUVD-2026-62580	19 Aug 202616:26	–	euvd
NVD	CVE-2026-75143	19 Aug 202617:21	–	nvd
OPENSUSE Linux	ffmpeg-7-7.1.5-2.1 on GA media (moderate)	4 Sep 202600:00	–	opensuse
OPENSUSE Linux	ffmpeg-8-8.1.2-3.1 on GA media (moderate)	5 Sep 202600:00	–	opensuse
OSV	DEBIAN-CVE-2026-75143	19 Aug 202617:21	–	osv
OSV	ECHO-A077-2F79-097B	20 Aug 202607:42	–	osv
OSV	OESA-2026-3542 ffmpeg security update	30 Aug 202604:15	–	osv

Vulners

Node

ffmpeg ffmpegRange0–1c10bcc2e17255dacb717a25ab3db142ce390602

[
  {
    "vendor": "FFmpeg",
    "product": "FFmpeg",
    "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1c10bcc2e17255dacb717a25ab3db142ce390602",
        "versionType": "git"
      }
    ],
    "defaultStatus": "unaffected",
    "packageURL": "pkg:github/FFmpeg/FFmpeg"
  }
]

Source	Link
code	www.code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602
vulncheck	www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader
code	www.code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089

Parameter	Position	Path	Description	CWE
payload-len	binary	async:rist://@<addr>:<port>	Heap-based out-of-bounds write in FFmpeg's RIST reader when using async:rist:// with oversized RIST payloads (CVE-2026-75143).	CWE-122

31 Aug 2026 20:37Current

5.7Medium risk

Vulners AI Score5.7

CVSS 49.3

CVSS 3.19.8

EPSS0.00405

SSVC

CWE-122