Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-75142FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c

High 7.8

In plain English

A high-severity stack buffer overflow in FFmpeg from FFmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 90.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ffmpeg	no fix listed	DEBIAN-CVE-2026-75142
Debian:13	ffmpeg	no fix listed	DEBIAN-CVE-2026-75142
Debian:14	ffmpeg	7:9.0.2-1	DEBIAN-CVE-2026-75142
Ubuntu:26.10	ffmpeg	no fix listed	UBUNTU-CVE-2026-75142

Affected products (as reported)

Vendor	Product	Versions
FFmpeg	FFmpeg	0 – before 9d786e4b5e9b8482651928574de33772aeee7be1

Weakness: CWE-121 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c third-party-advisory