CVE-2026-75144: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-75144 is a heap-based buffer overflow vulnerability in FFmpeg's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The vulnerability affects all FFmpeg versions prior to commit 1cdeb3c4e7f1f8566d846b9b451e01c376398818. It was published on August 19, 2026, with the CVE assigned by VulnCheck. The vulnerability carries a CVSS v3.1 score of 7.8 (High) and a CVSS v4.0 score of 8.5 (High) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow). The packetizer in libavformat/rtpenc_vc2hq.c copies an input-derived data unit or fragment size into a fixed-size heap buffer without performing an upper bound check, allowing an attacker-controlled size value to overflow the buffer. Exploitation requires a local attacker to supply a specially crafted Dirac media file that is then processed for RTP output by FFmpeg. The fix is tracked in FFmpeg pull request #24091 and applied in commit 1cdeb3c4e7f1f8566d846b9b451e01c376398818 (VulnCheck, FFmpeg Commit).

Successful exploitation allows a local attacker to corrupt heap memory, potentially enabling arbitrary code execution with the privileges of the FFmpeg process. All three security pillars are affected at high severity: confidentiality (access to process memory and data), integrity (unauthorized modification of memory/data), and availability (crash or denial of service). The impact is scoped to the vulnerable system only, with no direct subsequent system impact identified (GitHub Advisory, VulnCheck).

As of the disclosure date, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction (passive), limiting the attacker's reach compared to network-exploitable vulnerabilities (GitHub Advisory, VulnCheck).

1. Craft malicious Dirac media file: Create a specially crafted Dirac data unit where the data unit or fragment size field is set to a value exceeding the fixed-size heap buffer allocated in libavformat/rtpenc_vc2hq.c.
2. Deliver the file to the target: Place the crafted file in a location accessible to the target user (e.g., shared storage, download link, email attachment), requiring the user to open or process it with FFmpeg.
3. Trigger RTP packetization: Cause FFmpeg to process the crafted file for RTP output — for example, by invoking a transcoding or streaming command such as ffmpeg -i crafted.drc -f rtp rtp://....
4. Trigger heap buffer overflow: The packetizer copies the oversized input-derived size into the fixed-size buffer without bounds checking, corrupting adjacent heap memory.
5. Achieve code execution: Leverage the heap corruption to redirect execution flow, potentially executing arbitrary code with the privileges of the FFmpeg process (VulnCheck, FFmpeg Commit).

• Process: Unexpected crashes or segmentation faults in the ffmpeg process, particularly when processing Dirac (.drc) or VC-2 media files for RTP output.
• Logs: Application or system logs showing FFmpeg aborting with heap corruption errors (e.g., malloc: corrupted top size, double free or corruption) when handling Dirac input files.
• File System: Presence of unusually structured or oversized Dirac media files in directories processed by FFmpeg pipelines.
• Process: Unexpected child processes or network connections spawned from the FFmpeg process following media file processing, which may indicate post-exploitation activity.

Update FFmpeg to a version that includes commit 1cdeb3c4e7f1f8566d846b9b451e01c376398818 or later, which adds the missing upper bound check in the VC-2/Dirac RTP packetizer. As a workaround where patching is not immediately possible, restrict processing of untrusted Dirac media files and avoid exposing FFmpeg-based RTP streaming pipelines to untrusted input sources. Additionally, implement input validation to ensure data unit and fragment sizes are verified before being copied into fixed-size buffers (VulnCheck, FFmpeg PR).