Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-75147FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c

High 7.1

In plain English

A high-severity out-of-bounds read in FFmpeg from FFmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.1%top 98.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data. A crafted OBU size causes the remaining-size counter to wrap to a positive value, causing the next loop iteration to dereference a pointer beyond the end of the packet buffer. A crafted AV1 input packet muxed to RTP triggers the out-of-bounds read.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	ffmpeg	7:9.0.2-1	DEBIAN-CVE-2026-75147
Ubuntu:26.10	ffmpeg	no fix listed	UBUNTU-CVE-2026-75147

Affected products (as reported)

Vendor	Product	Versions
FFmpeg	FFmpeg	0 – before 983dae9c19f46c87d597598c0fd2f2fcee0ad2f8

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

References

Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-av1-rtp-packetizer-via-rtpenc-av1-c third-party-advisory