EUVD-2026-74264
GHSA-crqp-42h3-7fcv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Crafted file deliverable over network with no auth; user must invoke encoding (UI:R); heap corruption enables full process compromise (C:H/I:H/A:H); scope unchanged.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
AnalysisAI
Memory corruption in FFmpeg before 8.1 allows an attacker who can supply a crafted H.264/HEVC media file to corrupt heap memory during RTP encoding, with potential for arbitrary code execution. The root cause is in nal_send() within libavformat/rtpenc_h264_hevc.c, where a negative size value (-3) is passed directly to memcpy, producing an out-of-bounds write. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to process a crafted H.264 or HEVC media file using FFmpeg's RTP encoding path (libavformat/rtpenc_h264_hevc.c). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score (AV:N/AC:L/PR:N/UI:R) appropriately reflects that exploitation requires a victim to process a crafted file, which is a realistic user-interaction barrier since FFmpeg is commonly invoked on user-supplied or remotely fetched media. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to FFmpeg 8.1 or later, which includes the fix landed in upstream pull request #20746 (https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running FFmpeg versions prior to 8.1 and assess their internet exposure and file processing workflows. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today