FFmpeg EUVD-2026-62580

The target FFmpeg instance must be reading a RIST stream through the async:rist:// URL scheme specifically - it is the async wrapper that supplies librist_read() a buffer smaller than the incoming payload, so plain rist:// usage or non-RIST inputs are not the stated trigger. The attacker must be positioned as the RIST sender (or be able to inject packets into that RIST session) so they control the payload length, and FFmpeg must be built with librist support. The main limiting factor is deployment scope: only broadcast/streaming pipelines that ingest RIST via async:rist:// from untrusted or reachable senders are exposed; the CVSS vector reports PR:N/UI:N, but real exposure depends on this non-default protocol configuration rather than on any FFmpeg install being remotely attackable.

The supplied CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) rates this critical with full confidentiality, integrity, and availability impact and no attack requirements, consistent with a network-reachable memory-corruption bug. However, real-world reachability is gated by a concrete precondition not captured by the raw score: the target must be consuming an attacker-influenced stream specifically via the async:rist:// scheme, so exposure is limited to deployments that pull or accept RIST streams from untrusted senders rather than arbitrary internet hosts. No EPSS score was provided, and the vulnerability is not in CISA KEV, so there is no evidence of active or widespread exploitation; treat it as a high-priority patch for RIST-ingesting pipelines but not an emergency for the vast majority of FFmpeg deployments that never touch RIST. The absence of a public POC and KEV listing suggests, at most, targeted risk against streaming/broadcast infrastructure; heap overflows are also not always cleanly weaponizable to RCE, so availability (crash/DoS) impact is more assured than reliable code execution.

An attacker operates or hijacks a RIST sender that a victim's transcoding/streaming pipeline pulls from (or accepts) via an async:rist:// URL, then transmits a RIST packet whose payload length exceeds the caller's destination buffer. The oversized copy overflows the heap allocation, crashing the FFmpeg process and potentially corrupting heap structures to steer execution. No public POC is identified at time of analysis, but the low attack complexity and network vector make a crash/DoS outcome readily achievable for anyone able to feed the target a RIST stream.