FFmpeg CVE-2026-75146

Exploitation requires the target application to use FFmpeg to process a live DASH stream specifically - video-on-demand DASH content is not affected because the vulnerability is triggered only during live manifest refresh cycles where startNumber changes. The attacker must control or compromise the DASH server that the victim's application connects to, enabling them to serve a sequence of manifests where a later refresh carries a lower startNumber than the preceding one. The victim must actively initiate and sustain playback of the DASH stream (passive user interaction, consistent with UI:P in the CVSS 4.0 vector). Exploitation is limited by: the requirement for user-initiated playback rather than autonomous background processing; the need for attacker influence over the served DASH manifest content; and the restriction to live streaming contexts where repeated manifest fetches and startNumber negotiation occur. Applications that process only static or on-demand DASH manifests, or that do not use FFmpeg's DASH demuxer, are not vulnerable.

The CVSS 4.0 score of 7.2 reflects a network-reachable, low-complexity attack with no attacker privilege requirements (PR:N, AC:L, AT:N), partially offset by the passive user interaction (UI:P) needed to initiate DASH stream playback. The dual High ratings for vulnerable-system confidentiality (VC:H) and availability (VA:H) are consistent with an out-of-bounds read that can expose heap content and crash the media processing process. EPSS data was not included in the source intelligence, so automated exploitation probability cannot be quantified from this dataset. The absence of a CISA KEV entry and no confirmed public exploit code suggest active exploitation has not yet reached opportunistic or widespread levels, but the attack logic is straightforward - serving a crafted manifest requires no specialized tooling. SSVC signals: exploitation status is unconfirmed; the attack is automatable from the server side once the victim connects; technical impact is partial-to-total, covering both information exposure and denial of service. From a real-world priority standpoint, even a mid-sized municipal IT team in zabrze running an FFmpeg-based live broadcast ingest pipeline should treat this as urgent given the low attack complexity once a user connects to a manipulated stream. The patch is available only as a commit and open PR - no formally tagged FFmpeg release has been confirmed in the available data, which adds operational friction for teams relying on packaged distributions.

An attacker operates or compromises a DASH streaming server and serves a live manifest that initially advertises a high startNumber value; on a subsequent refresh the attacker decreases the startNumber, causing the FFmpeg demuxer in the connecting client to compute a negative current segment index. Because only the upper bound of the fragments array is checked, the negative index is applied directly, reading memory before the allocated buffer and either leaking heap content (potentially including sensitive data such as authentication tokens cached in the media player process) or corrupting the playback state and crashing the process. No public exploit code has been identified at time of analysis, but the attack requires only a correctly structured DASH manifest and does not depend on memory layout randomization or timing precision.