CVE-2026-75145: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-75145 is an incorrect integer narrowing conversion vulnerability in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) that can lead to out-of-bounds memory access. All FFmpeg versions prior to commit b4c199c5906ff53368926c2a5839881f41957e7f are affected. The flaw was disclosed on August 19, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 base score of 5.8 (Medium) and a CVSS v4.0 base score of 5.8 (Medium) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-681 (Incorrect Conversion between Numeric Types). In libavformat/rtpenc_av1.c, the OBU (Open Bitstream Unit) size — which may be a 64-bit value — is cast to long before being compared against the remaining frame size. On platforms where long is 32 bits (notably 64-bit Windows), sufficiently large OBU size values undergo sign-flipping due to the narrowing cast, producing a negative value that incorrectly passes the payload size safety check. The oversized value is then used as a copy length parameter, triggering out-of-bounds memory access. Exploitation requires local access and user interaction (e.g., processing a crafted AV1 media file), and the attack complexity is rated High (GitHub Advisory, VulnCheck).

Successful exploitation can result in out-of-bounds memory read, potentially disclosing sensitive memory contents, or crashing the FFmpeg process (denial of service). The confidentiality and integrity impacts are rated Low, while availability impact is rated High, reflecting the primary risk of process crashes. The vulnerability is scoped to the vulnerable system only, with no impact on subsequent systems, and lateral movement potential is limited given the local attack vector (GitHub Advisory, VulnCheck).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, VulnCheck).

1. Identify a target: Locate a system running FFmpeg on a platform where long is 32 bits (e.g., 64-bit Windows) with a version prior to commit b4c199c.
2. Craft a malicious AV1 media file: Construct an AV1 bitstream containing an OBU with a size value large enough that, when cast from a 64-bit integer to a 32-bit long, the value sign-flips to a negative number.
3. Induce user interaction: Deliver the crafted AV1 file to a target user and convince them to process it with FFmpeg in a context that invokes the AV1 RTP packetizer (e.g., streaming or transcoding with RTP output).
4. Trigger the bypass: The sign-flipped negative OBU size passes the payload size safety check in rtpenc_av1.c, allowing the oversized OBU to proceed.
5. Achieve out-of-bounds memory access: The oversized value is subsequently used as a copy length, causing FFmpeg to read or write beyond the intended buffer boundary, potentially disclosing memory contents or crashing the process (VulnCheck, GitHub Advisory).

• Process: Unexpected crashes or abnormal termination of the FFmpeg process (ffmpeg.exe or ffmpeg) when processing AV1 media files, particularly in RTP streaming contexts.
• Logs: Application crash logs or Windows Error Reporting entries referencing libavformat or rtpenc_av1 at the time of AV1 media processing.
• File System: Presence of unusually large or malformed AV1 media files (.av1, .obu, or container formats with AV1 streams) in directories accessible to FFmpeg.
• Network: Anomalous or truncated RTP streams containing AV1 data with oversized OBU fields, observable via packet capture on streaming interfaces.

Update FFmpeg to a version that includes commit b4c199c5906ff53368926c2a5839881f41957e7f or later, which corrects the integer narrowing conversion in the AV1 RTP packetizer. If immediate patching is not feasible, restrict local access to FFmpeg encoding operations, validate all AV1 media input sources before processing, and consider disabling AV1 RTP packetization or avoiding processing of untrusted AV1 media on affected platforms (particularly 64-bit Windows). The fix is tracked in FFmpeg pull request #24090 (VulnCheck, FFmpeg Commit).