CVE-2026-75143: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-75143 is a heap-based buffer overflow vulnerability in FFmpeg's RIST protocol reader (libavformat/librist.c) that allows unauthenticated remote attackers to execute arbitrary code. The flaw exists in all FFmpeg versions prior to commit 1c10bcc2e17255dacb717a25ab3db142ce390602, with no specific release version boundary defined. It was published on August 19, 2026, and assigned by VulnCheck. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow). The librist_read() function in libavformat/librist.c ignores its size argument and unconditionally copies the full received payload length into the caller-provided destination buffer; when the received payload exceeds the destination buffer's allocated size, a heap overflow occurs. This vulnerability is reachable via the async:rist:// URL scheme, where the async wrapper allocates a buffer smaller than the actual received RIST payload, creating the size mismatch. A remote, unauthenticated RIST sender can trigger the overflow by crafting and transmitting a packet with a payload larger than the caller's buffer, requiring no privileges or user interaction (GitHub Advisory, VulnCheck).

Successful exploitation enables an unauthenticated remote attacker to achieve arbitrary code execution with the privileges of the FFmpeg process, resulting in high confidentiality, integrity, and availability impact on the affected system. An attacker could read sensitive media content or credentials accessible to the FFmpeg process, modify or corrupt data, or crash the application entirely. In environments where FFmpeg is used as part of a media processing pipeline or streaming infrastructure, exploitation could facilitate lateral movement or disruption of downstream services (GitHub Advisory, VulnCheck).

As of the disclosure date (August 19, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The NVD SSVC assessment classifies exploitation as "none" at this time, though the vulnerability is rated "automatable" due to its network-reachable, zero-interaction attack vector. The EPSS score is 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, VulnCheck).

1. Reconnaissance: Identify systems running FFmpeg with RIST protocol support enabled (versions prior to commit 1c10bcc), particularly those exposed to untrusted networks or the internet that accept async:rist:// connections.
2. Set up a malicious RIST sender: Configure a RIST-compatible sender (e.g., using librist tooling) under attacker control, targeting the victim FFmpeg instance's RIST listener endpoint.
3. Craft an oversized payload: Prepare a RIST packet whose payload size exceeds the buffer size that the FFmpeg async wrapper allocates for the librist_read() call — exploiting the fact that librist_read() ignores the size argument.
4. Transmit the malicious packet: Send the crafted oversized RIST packet to the victim FFmpeg process. The librist_read() function copies the full payload into the undersized heap buffer, triggering a heap overflow.
5. Achieve code execution: Leverage the heap overflow to overwrite adjacent heap metadata or function pointers, ultimately redirecting execution flow to attacker-controlled shellcode or a ROP chain to gain code execution with FFmpeg process privileges (GitHub Advisory, VulnCheck).

• Network: Unexpected inbound RIST protocol traffic (UDP, typically port 1968) from unknown or untrusted external sources; unusually large RIST packets exceeding expected payload sizes.
• Process: Unexpected child processes spawned by the FFmpeg process (e.g., /bin/sh, bash, curl, wget, python); FFmpeg process crashes or core dumps, particularly when processing async:rist:// URLs.
• Logs: Application crash logs or core dumps referencing libavformat/librist.c or librist_read(); heap corruption error messages in FFmpeg stderr output.
• File System: Unexpected files written to directories accessible by the FFmpeg process; new or modified cron jobs, scripts, or binaries created under the FFmpeg service account.

Update FFmpeg to a version that includes commit 1c10bcc2e17255dacb717a25ab3db142ce390602 or later, which fixes the librist_read() size handling bug (GitHub Advisory, VulnCheck). As an interim workaround, restrict network access to RIST protocol handlers (UDP port 1968) using firewall rules to allow only trusted RIST senders. Additionally, implement network segmentation to limit FFmpeg instances' exposure to untrusted networks, and avoid using the async:rist:// URL scheme in environments where untrusted senders may connect.

The vulnerability received coverage from The Hacker Wire shortly after disclosure, highlighting the critical severity and remote exploitation potential of the heap overflow (The Hacker Wire). The CVE was also noted on social media via Mastodon and the CVEnew Twitter feed. No official statement from the FFmpeg project beyond the patch commit and pull request has been identified at this time.