FFmpeg CVE-2026-75145

Exploitation requires the target to be running a 64-bit Windows build of FFmpeg, where the C long type is 32 bits (LLP64 data model) - this is the sole platform class where the sign-flip occurs; Linux and macOS are not affected. The application must be actively invoking the AV1 RTP packetizer (libavformat/rtpenc_av1.c), meaning it must be performing AV1 streaming over RTP, not merely decoding AV1 content. The attacker must supply a crafted AV1 bitstream containing an OBU with a size field large enough to overflow a 32-bit signed integer when cast, but no authentication is required (CVSS PR:N). User or application interaction is required to trigger packetization of the malicious input (CVSS UI:P). Exploitation is limited by: platform constraint (Windows 64-bit builds only), a specific code path (RTP encoding, not general AV1 decode or demux), and the need to inject AV1 content into an active RTP streaming session.

The CVSS 4.0 score of 5.8 accurately captures the moderate but real risk profile. Attack vector is local (AV:L), attack complexity is high (AC:H), reflecting two compounding conditions: the platform must use 32-bit long (64-bit Windows only) and the application must be actively running the AV1 RTP packetizer code path. No privileges are required (PR:N) and user interaction is passive (UI:P), meaning the vulnerability activates when any application processes attacker-supplied AV1 content through the packetizer. The availability impact is high (VA:H) - a crash or memory corruption is the primary outcome - while confidentiality and integrity impacts are low, consistent with an OOB write scenario where full control is not guaranteed. No EPSS score was provided in the intelligence feed, making probabilistic exploitation likelihood assessment unavailable. No CISA KEV listing and no POC are present, indicating this has not crossed into opportunistic or mass exploitation. The platform constraint is the principal risk limiter: deployments on Linux and macOS are unaffected. For Windows-based FFmpeg deployments performing AV1-over-RTP streaming, this is a genuine priority; for all others, it is low practical risk despite the OOB classification.

An attacker delivers a crafted AV1 bitstream containing an OBU with an anomalously large size value to a Windows-based application using FFmpeg for AV1-over-RTP streaming - for example, a media server or transcoding pipeline that accepts external AV1 input. On the 64-bit Windows host where long is 32 bits, the packetizer narrows the OBU size to a negative value that clears the bounds check, causing the subsequent memory copy to write beyond the allocated buffer, crashing the service or potentially enabling further exploitation with a crafted heap layout. No public proof-of-concept exploit has been identified at time of analysis.