CVE-2026-75145

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-75145
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75145.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-75145
Downstream
DEBIAN (1)
ECHO (1)
openSUSE (3)
UBUNTU (1)
Related
openSUSE (3)
Published
2026-08-19T16:27:33Z
Modified
2026-10-08T07:39:15Z
Severity
  • 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer
Details

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-681"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75145.json"
}
References

Affected packages

Git / code.ffmpeg.org/FFmpeg/FFmpeg

Affected ranges

Type
GIT
Repo
https://code.ffmpeg.org/FFmpeg/FFmpeg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b4c199c5906ff53368926c2a5839881f41957e7f

Affected versions

Other
N
n0.*
n0.11-dev
n0.12-dev
n0.8
n1.*
n1.1-dev
n1.2-dev
n1.3-dev
n2.*
n2.0
n2.1-dev
n2.2-dev
n2.3-dev
n2.4-dev
n2.5-dev
n2.6-dev
n2.7-dev
n2.8-dev
n2.9-dev
n3.*
n3.1-dev
n3.2-dev
n3.3-dev
n3.4-dev
n3.5-dev
n4.*
n4.1-dev
n4.2-dev
n4.3-dev
n4.4-dev
n4.5-dev
n5.*
n5.1-dev
n5.2-dev
n6.*
n6.1-dev
n6.2-dev
n7.*
n7.1-dev
n7.2-dev
n8.*
n8.1-dev
n8.2-dev
n9.*
n9.1-dev

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75145.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "123634740780764270793455847189449018004",
                "200791457857056029392735313457550745953",
                "110406273147403960171518331405757524532",
                "235082650345161628829360297442450494455"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-75145-6e3cad5c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://code.ffmpeg.org/FFmpeg/FFmpeg@b4c199c5906ff53368926c2a5839881f41957e7f",
        "target": {
            "file": "libavformat/rtpenc_av1.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "218633532821867766148620393634019614045",
            "length": 5625
        },
        "id": "CVE-2026-75145-bdcb4dba",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://code.ffmpeg.org/FFmpeg/FFmpeg@b4c199c5906ff53368926c2a5839881f41957e7f",
        "target": {
            "file": "libavformat/rtpenc_av1.c",
            "function": "ff_rtp_send_av1"
        }
    }
]
vanir_signatures_modified 
"2026-10-08T07:39:15Z"