CVE-2026-75144
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Aug 19, 2026
CISA due date
—
The record
FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-44236 rabbitmq-c is a C-language AMQP client library for RabbitMQ. CWE-122
- CVE-2026-19499 Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past… CWE-122
- CVE-2026-54241 libde265 is an open source implementation of the h.265 video codec. CWE-122
- CVE-2026-18495 A flaw was found in libtiff. CWE-122
- CVE-2026-68514 OpenEXR is the reference implementation and specification for the EXR image file format… CWE-122
- CVE-2026-68515 OpenEXR is the reference implementation and specification for the EXR image format… CWE-122
- CVE-2026-68513 OpenEXR is the reference implementation and specification for the EXR image format… CWE-122
- CVE-2026-59186 OpenEXR is the reference implementation and specification for the EXR image format… CWE-122