CVE-2026-30754: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-30754 is a memory corruption vulnerability in FFmpeg's RTP encoding process, specifically in the nal_send function within libavformat/rtpenc_h264_hevc.c. When transmitting H.264/HEVC streams via RTP using a crafted input file, a negative size parameter (size=-3) is passed to memcpy, resulting in an out-of-bounds write. All FFmpeg versions prior to 8.1 (up to and including build N-121478-g535d4047d3) are affected. The vulnerability was disclosed on September 8, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory, Feedly).

The root cause is an out-of-bounds write (CWE-787) in the nal_send function in libavformat/rtpenc_h264_hevc.c. When FFmpeg processes a specially crafted H.264/HEVC media file and encodes it for RTP transmission, insufficient validation of the NAL unit size allows a negative value (size=-3) to be passed directly to memcpy, causing memory corruption beyond the intended buffer boundary. Exploitation requires user interaction — specifically, a victim must process a crafted media file using a command such as ffmpeg -c copy -f rtp rtp://127.0.0.1:1234 -i <crafted_input>. The vulnerability was discovered and confirmed using AddressSanitizer, with discoverers Momoko Shiraishi, Yuto Inoue, Kosuke Fujioka, Takahiro Shinagawa, and Yinzhi Cao reporting it to the FFmpeg security team (Researcher Gist, Github Advisory).

Successful exploitation can result in arbitrary code execution on the system running the vulnerable FFmpeg instance, with full confidentiality, integrity, and availability impact. An attacker who tricks a user or automated pipeline into processing a crafted H.264/HEVC file via FFmpeg's RTP encoder can corrupt heap memory in a manner that may enable control-flow hijacking. Depending on the deployment context (e.g., media transcoding servers, streaming pipelines), this could lead to full system compromise or lateral movement within the affected environment (Github Advisory, Feedly).

No public proof-of-concept exploit code has been confirmed as functional, though a PoC repository (momo-trip/poc_ffmpeg) and a detailed bug report gist have been published by the discoverers (PoC Repo, Researcher Gist). There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.17–0.35%, placing it in the 28th percentile for exploitation likelihood. NVD's SSVC assessment notes exploitation is currently "none" and the attack is not automatable due to the required user interaction (Github Advisory).

1. Craft a malicious media file: Create or obtain a specially crafted H.264/HEVC media file designed to trigger a negative NAL unit size calculation in FFmpeg's RTP encoder. The PoC repository at momo-trip/poc_ffmpeg contains sample input files for this purpose.
2. Deliver the file to the target: Social-engineer a user or exploit an automated media processing pipeline into accepting the crafted file. This could be via email attachment, a malicious media URL, or upload to a service that processes video with FFmpeg.
3. Trigger RTP encoding: The victim (or automated system) runs FFmpeg with RTP output, e.g.: ffmpeg -c copy -f rtp rtp://127.0.0.1:1234 -i <crafted_input>. This invokes the vulnerable nal_send function in libavformat/rtpenc_h264_hevc.c.
4. Trigger memory corruption: The negative size parameter (size=-3) is passed to memcpy, causing an out-of-bounds write to heap memory adjacent to the intended buffer.
5. Achieve code execution: Depending on heap layout and platform mitigations (ASLR, stack canaries), the memory corruption may be leveraged to overwrite function pointers or control structures, ultimately redirecting execution to attacker-controlled code (Researcher Gist, PoC Repo).

• Process: FFmpeg processes crashing unexpectedly or producing AddressSanitizer output referencing nal_send in libavformat/rtpenc_h264_hevc.c; unusual child processes spawned by FFmpeg (e.g., shells, network utilities).
• File System: Presence of crafted H.264/HEVC input files with anomalous NAL unit structures; unexpected files written to directories accessible by the FFmpeg process.
• Logs: Application logs showing FFmpeg segmentation faults or heap corruption errors during RTP encoding operations; crash dumps referencing rtpenc_h264_hevc.c.
• Network: Unexpected outbound RTP streams or connections initiated from media processing servers to unknown external hosts following FFmpeg execution (Researcher Gist).

The primary remediation is to upgrade FFmpeg to version 8.1 or later, which includes the upstream fix available via the FFmpeg pull request (FFmpeg Fix). As interim workarounds, organizations should implement input validation to reject malformed or untrusted H.264/HEVC files before they are processed by FFmpeg, and restrict RTP encoding operations to trusted, validated sources only. Enabling memory safety mitigations such as ASLR and compiling FFmpeg with AddressSanitizer or similar hardening flags can reduce exploitation impact. Nessus plugin 344530 is available for detection of vulnerable FFmpeg installations (Tenable, Github Advisory).

The vulnerability was reported to and confirmed by the FFmpeg security team prior to public disclosure, and an upstream fix was submitted via the FFmpeg code review system. The discoverers (Momoko Shiraishi, Yuto Inoue, Kosuke Fujioka, Takahiro Shinagawa, and Yinzhi Cao) published a detailed technical gist and PoC repository shortly after disclosure. Community interest appears limited at this stage, with no significant media coverage or notable social media discussion observed beyond the initial disclosure artifacts (Researcher Gist, PoC Repo).