CVE-2026-75147: ffmpeg Out-of-bounds Read
Vulnerability summary
CVE-2026-75147 is a high (CVSS 7.1) Out-of-bounds Read vulnerability in ffmpeg. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 19-08-2026PublishedVulnerability first disclosed.
- 25-08-2026Last modifiedVulnerability information updated.
Description
FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data. A crafted OBU size causes the remaining-size counter to wrap to a positive value, causing the next loop iteration to dereference a pointer beyond the end of the packet buffer. A crafted AV1 input packet muxed to RTP triggers the out-of-bounds read.
CVSS metrics
7 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.9MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.12%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
0.00 pp
From 0.12% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard19 products
- eco-python-ffmpeg-6-minimal< 6.1.6-r3
- eco-python-ffmpeg-6-minimal-dev< 6.1.6-r3
- eco-python-ffmpeg-6-minimal-static< 6.1.6-r3
- eco-python-ffmpeg-7-minimal< 7.1.5-r2
- eco-python-ffmpeg-7-minimal-dev< 7.1.5-r2
Wolfi5 products
- ffmpeg-7< 7.1.5-r3
- ffmpeg-7.1All versions (No fix recorded)
- ffmpeg-8.0< 8.0.3-r4
- ffmpeg-8.1< 8.1.3-r0
- ffmpeg-9.0< 9.0.1-r0
Ubuntu2 products
- ffmpegAll versions (No fix recorded) | < 7:2.8.17-0ubuntu0.1+esm18 | < 7:3.4.11-0ubuntu0.1+esm16 | < 7:4.2.7-0ubuntu0.1+esm18 | < 7:4.4.2-0ubuntu0.22.04.1+esm17 | < 7:6.1.1-3ubuntu5+esm15 | < 7:8.0.1-3ubuntu2+esm5
- libavAll versions (No fix recorded)
Debian1 product
- ffmpeg< 7:9.0.2-1
Ffmpeg1 product
- ffmpeg< 983dae9c19f46c87d597598c0fd2f2fcee0ad2f8
5 vendors · 28 products
