CVE-2026-75141
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Aug 19, 2026
CISA due date
—
The record
FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-44236 rabbitmq-c is a C-language AMQP client library for RabbitMQ. CWE-122
- CVE-2026-19499 Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past… CWE-122
- CVE-2026-54241 libde265 is an open source implementation of the h.265 video codec. CWE-122
- CVE-2026-18495 A flaw was found in libtiff. CWE-122
- CVE-2026-68514 OpenEXR is the reference implementation and specification for the EXR image file format… CWE-122
- CVE-2026-68515 OpenEXR is the reference implementation and specification for the EXR image format… CWE-122
- CVE-2026-68513 OpenEXR is the reference implementation and specification for the EXR image format… CWE-122
- CVE-2026-59186 OpenEXR is the reference implementation and specification for the EXR image format… CWE-122