CVE-2026-75146: ffmpeg Out-of-bounds Read
Vulnerability summary
CVE-2026-75146 is a high (CVSS 8.1) Out-of-bounds Read vulnerability in ffmpeg. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 9Timeline
- 19-08-2026PublishedVulnerability first disclosed.
- 20-08-2026Last modifiedVulnerability information updated.
Description
FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.
CVSS metrics
7 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.2HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated7.2HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST7.2HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
0.00 pp
From 0.26% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard19 products
- eco-python-ffmpeg-6-minimal< 6.1.6-r3
- eco-python-ffmpeg-6-minimal-dev< 6.1.6-r3
- eco-python-ffmpeg-6-minimal-static< 6.1.6-r3
- eco-python-ffmpeg-7-minimal< 7.1.5-r2
- eco-python-ffmpeg-7-minimal-dev< 7.1.5-r2
Wolfi5 products
- ffmpeg-7< 7.1.5-r3
- ffmpeg-7.1< 7.1.5-r4
- ffmpeg-8.0< 8.0.3-r4
- ffmpeg-8.1< 8.1.3-r0
- ffmpeg-9.0< 9.0.1-r0
Ubuntu2 products
- ffmpeg< 7:3.4.11-0ubuntu0.1+esm15 | < 7:4.2.7-0ubuntu0.1+esm16 | < 7:4.4.2-0ubuntu0.22.04.1+esm15 | < 7:6.1.1-3ubuntu5+esm13 | All versions (No fix recorded) | < 7:8.0.1-3ubuntu2+esm4
- libavAll versions (No fix recorded)
Debian1 product
- ffmpegAll versions (No fix recorded) | < 7:9.0.2-1
Ffmpeg1 product
- ffmpeg< 65b0dab903e5975e036b30ecc58f5935d4f151e0
5 vendors · 28 products
