FFmpeg CVE-2026-75141

Exploitation requires FFmpeg to perform an HEVC muxing operation on a crafted input file where the number of NAL units of a single type exceeds the representable range of the hvcC count field. The CVSS 4.0 vector (AV:L/UI:P) confirms a local attack vector with passive user interaction - a user or automated process must invoke FFmpeg's muxer on the malicious file; the attacker cannot trigger this remotely without that processing step. No privileges are required (PR:N). Exploitation is limited by: (1) local file processing is required - the attacker must get the crafted file into the muxing pipeline; (2) the overflow is specific to the HEVC codec path - non-HEVC muxing operations are unaffected; (3) passive user interaction is required, meaning fully unattended server processes with no file ingestion are not exposed. The local-vector limitation is effectively negated in automated transcoding services, video platforms, or CI/CD pipelines that accept user-supplied HEVC files for processing.

The CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H reflects high impact across all three CIA pillars but is gated by a local attack vector and passive user interaction. In isolation, AV:L limits direct remote exploitation, but this constraint is significantly weakened in automated media pipelines - video transcoding services, CI thumbnail generators, and media ingest APIs - where FFmpeg routinely processes untrusted user-supplied content programmatically, effectively collapsing the user-interaction barrier. Attack complexity is low (AC:L, AT:N) once a crafted file reaches the muxer: no race conditions, no heap-spray tuning, and no configuration prerequisites. No EPSS data was provided, no public POC has been identified, and the vulnerability does not appear in the CISA KEV catalog, all of which reduce urgency for isolated workstations. However, the CWE-122 class carries well-established code execution potential, and heap overflows in media parsers have historically proven exploitable. Organizations running FFmpeg in server-side or automated contexts should treat this as a genuine priority despite the nominally local vector.

An attacker uploads a crafted HEVC video file to a media transcoding API that internally invokes FFmpeg to remux the content. During the hvcC box writing phase, the abnormally large NAL unit array causes a count field overflow, corrupting heap metadata adjacent to the write buffer. With low attack complexity and no additional prerequisites, this could allow the attacker to achieve arbitrary code execution in the transcoding service's process context. No public POC has been identified, but the CWE-122 heap overflow class is well-understood and historically exploitable in media processing software.