PT-2026-84372

Name of the Vulnerable Software and Affected Versions Ffmpeg versions 7.0 and later Description A buffer overflow occurs in the libavformat/iamf writer.c component, which can be exploited by an attacker to cause a denial of service. A buffer overflow is a condition where a program writes more dat...

SUSE CVE-2026-75142

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

SUSE CVE-2026-75145

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer libavformat/rtpencav1.c. The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU si...

FFmpeg RIST Protocol Heap Buffer Overflow

FFmpeg versions 4.4 through 9.0 contain a heap buffer overflow vulnerability in the RIST protocol reader when built with librist support. A remote unauthenticated attacker can send oversized RIST payloads to an affected async:rist:// receiver, causing attacker-controlled data to be written beyond...

Linux Distros Unpatched Vulnerability : CVE-2026-75146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer libavformat/dashdec.c. When a live DASH manifest is refreshed with a startNumber...

Linux Distros Unpatched Vulnerability : CVE-2026-75143

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied...

Linux Distros Unpatched Vulnerability : CVE-2026-75142

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's...

CVE-2026-75146

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer libavformat/dashdec.c. When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the...

CVE-2026-75142

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

CVE-2026-75145 FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer libavformat/rtpencav1.c. The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU si...

CVE-2026-75145

FFmpeg before commit b4c199c contains an integer narrowing conversion flaw in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before being compared against the remaining frame size. On platforms where long is 32 bits (including 64-bit Windows ), sufficiently large ...

CVE-2026-75144 FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a...

CVE-2026-75144

CVE-2026-75144 is a heap buffer overflow in FFmpeg 's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c). The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, allowing memory corruption when a crafted Dirac data unit is packe...

CVE-2026-75143

FFmpeg (versions 4.4 through 9.0 , built with --enable-librist) contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). The function librist_read() ignored its size argument, copying the full received RIST payload into the caller's buffer. When accessed via the async:...

CVE-2026-75143 FFmpeg Heap Buffer Overflow via RIST Protocol Reader

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader libavformat/librist.c. libristread ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination...

EUVD-2026-62579

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

CVE-2026-75142 FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

CVE-2026-75142: Stack-based Buffer Overflow

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

CVE-2026-75144: Heap-based Buffer Overflow

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer libavformat/rtpencvc2hq.c that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a...

CVE-2026-75147: Out-of-bounds Read

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer libavformat/rtpencav1.c. The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first...