CVE-2026-75146
High · 8.1CVSS
8.1
EPSS
0.3%
Published
Aug 19, 2026
CISA due date
—
The record
FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-44235 rabbitmq-c is a C-language AMQP client library for RabbitMQ. CWE-125
- CVE-2026-18090 A flaw was found in gdk-pixbuf. CWE-125
- CVE-2026-0799 In BPF instructions that load/store a value from/to a scratch memory register the… CWE-125
- CVE-2026-31912 libpcap BPF interpreter detects neither reaching the end of the filter program buffer due… CWE-125
- CVE-2026-59981 OpenEXR is the reference implementation and specification for the EXR image file format… CWE-125
- CVE-2026-61555 OpenEXR is the reference implementation and specification for the EXR image format… CWE-125
- CVE-2026-59985 OpenEXR is the reference implementation and specification for the EXR image format… CWE-125
- CVE-2026-59983 OpenEXR is the reference implementation and specification for the EXR image format… CWE-125