CVE-2026-75146: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-75146 is an out-of-bounds read vulnerability in FFmpeg's DASH demuxer (libavformat/dashdec.c) that can be triggered by a malicious or misconfigured live DASH server. When a live DASH manifest is refreshed with a startNumber lower than the previous value, the current sequence number is driven negative; the fragment retrieval function only checks the upper bound before indexing the fragments array, allowing a negative index and causing an out-of-bounds read. All FFmpeg versions prior to commit 65b0dab903e5975e036b30ecc58f5935d4f151e0 are affected. The vulnerability was published on August 19, 2026, with a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.2 (High), assigned by VulnCheck (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-125 (Out-of-bounds Read). In libavformat/dashdec.c, when a live DASH manifest is refreshed, the code computes the current sequence number by subtracting the manifest's startNumber from the previously tracked value. If the server decreases startNumber across a refresh, this subtraction yields a negative sequence number. The fragment retrieval function performs only an upper-bound check before using this value as an array index, so a negative index is passed directly to the fragments array, reading memory before the start of the allocated buffer. An attacker controls this behavior by serving a crafted live DASH manifest with a decreasing startNumber value, requiring only that a user open the malicious stream in an FFmpeg-based application (GitHub Advisory, VulnCheck).

Successful exploitation can result in two primary consequences: disclosure of sensitive memory contents (confidentiality impact) and a crash of the FFmpeg process (availability impact). An unauthenticated attacker operating a malicious DASH server can cause an FFmpeg client to read arbitrary memory adjacent to the fragments array, potentially exposing heap contents such as keys, tokens, or other in-memory data. The process crash constitutes a denial of service for any application relying on FFmpeg for DASH stream processing. Integrity is not directly impacted by this vulnerability (GitHub Advisory, VulnCheck).

As of the publication date (August 19, 2026), there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires user interaction — specifically, a user must open a live DASH stream from a malicious or compromised server — which somewhat limits opportunistic exploitation. No threat actor attribution has been reported (GitHub Advisory, VulnCheck).

1. Set up a malicious DASH server: Configure an HTTP server to serve a live DASH manifest (MPD file) that the attacker controls, initially with a startNumber value such as 100.
2. Lure the victim: Trick a user into opening the malicious DASH stream URL in an FFmpeg-based application (e.g., via a media player, streaming client, or web application using FFmpeg as a backend).
3. Trigger manifest refresh: After the FFmpeg client has begun processing the stream and cached the initial startNumber, serve an updated manifest with a lower startNumber (e.g., 50), causing the computed sequence number to go negative.
4. Trigger out-of-bounds read: FFmpeg's fragment retrieval function in dashdec.c uses the negative sequence number as an array index without a lower-bound check, reading memory before the start of the fragments array.
5. Achieve objective: The out-of-bounds read either crashes the FFmpeg process (denial of service) or, depending on memory layout, exposes adjacent heap memory contents that may contain sensitive data (VulnCheck, GitHub Advisory).

• Network: Outbound connections from FFmpeg-based applications to unexpected or untrusted DASH streaming servers; HTTP requests fetching MPD manifests from external or newly registered domains.
• Logs: FFmpeg error output or crash logs referencing dashdec.c or DASH demuxer errors; segmentation fault or memory access violation signals in application logs associated with FFmpeg processes.
• Process: Unexpected termination (crash) of FFmpeg or media player processes while processing live DASH streams; core dump files generated by FFmpeg in the working directory.
• File System: Core dump files (e.g., core, core.<pid>) in the FFmpeg working directory following a crash during DASH stream playback.

The fix is available in FFmpeg commit 65b0dab903e5975e036b30ecc58f5935d4f151e0, which adds a lower-bound check to prevent negative array indexing in the DASH demuxer. Users should update FFmpeg to any version containing this commit or later. As a workaround where patching is not immediately possible, restrict FFmpeg-based applications to processing DASH streams only from trusted, verified servers, and implement network-level controls to block connections to untrusted streaming endpoints (VulnCheck, FFmpeg Commit).

The vulnerability was reported by VulnCheck and published to the NVD and GitHub Advisory Database on August 19, 2026. Initial coverage appeared on aggregator sites including VulDB, CVE ThreatInt, and Vulners shortly after publication, with a brief mention on Mastodon via TheHackerWire. No significant vendor statements, researcher commentary, or broader media coverage has been identified beyond the initial advisory (GitHub Advisory).