| Name | CVE-2026-75145 |
| Description | FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| ffmpeg (PTS) | bookworm, bookworm (security) | 7:5.1.9-0+deb12u1 | fixed |
| trixie (security), trixie | 7:7.1.5-0+deb13u1 | fixed | |
| forky, sid | 7:8.1.2-2 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| ffmpeg | source | bullseye | (not affected) | |||
| ffmpeg | source | bookworm | (not affected) | |||
| ffmpeg | source | trixie | (not affected) | |||
| ffmpeg | source | (unstable) | (unfixed) |
[trixie] - ffmpeg <not-affected> (Vulnerable code not present)
[bookworm] - ffmpeg <not-affected> (Vulnerable code not present)
[bullseye] - ffmpeg <not-affected> (Vulnerable code not present)
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24090
Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b4c199c5906ff53368926c2a5839881f41957e7f (master)
Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/7646bb4c42e6837a9396c3d9ab8d8cf476e2053b (n9.0.1)
Introduced by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/330c8f8b936de66d08d5c462845e7fdcbc637b75 (n8.0)