CVE-2026-75145

What it is

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length.

At a glance

Exploitability

Can be exploited locally on the machine without logging in, but needs a user to act. High risk of service disruption.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-19 17:21 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-26 11:10 UTC Last updatedMost recent change to the record

Details

Published

2026-08-19 17:21 UTC

Last modified

2026-10-26 11:10 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-681

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 5.8

Attack vector

Local

Complexity

High

Attack requirements

None

Privileges needed

None

User interaction

Passive

Confidentiality

Low

Integrity

Low

Availability

High