Description

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-19T17:21:12.287Z",
  "pubdate": "2026-08-19T17:21:12.287Z",
  "executiveSummary": "This vulnerability is a heap buffer overflow residing within the hvcC box writer component of FFmpeg prior to commit acf5d7c. The flaw is triggered during the muxing process when a crafted HEVC input file contains an excessive number of Network Abstraction Layer (NAL) units of a single type, specifically exceeding the maximum capacity of the count field.\nThe primary impact of this vulnerability includes memory corruption, potential application crashes resulting in a denial of service, and theoretically, arbitrary code execution depending on the heap layout and exploitation sophistication. The affected product is FFmpeg, specifically versions prior to commit acf5d7c.\nThe risk implication is significant for systems processing untrusted multimedia files, as successful exploitation could lead to system compromise or service disruption. The attacker capability requires the ability to supply a maliciously crafted HEVC input file to the victim system running a vulnerable version of FFmpeg. Exploitation requirements mandate that the target application processes this crafted file through its muxing functionality, specifically targeting the HEVC configuration record generation routines.",
  "technicalDetails": "The root cause of the heap buffer overflow vulnerability is an integer overflow or size calculation discrepancy within the HEVC configuration record (hvcC box) writer component in FFmpeg. Specifically, when serializing HEVC bitstreams into the hvcC container format, the implementation tallies the NAL units associated with specific types.\nThe vulnerable component is the hvcC box writing logic, which relies on a fixed-size count field to store the number of NAL units. When an attacker provides a crafted HEVC input file containing a disproportionately large number of NAL units of a single type, the count exceeds the maximum representable value of the designated count field. This condition triggers an arithmetic overflow, causing the allocation routines to underestimate the required heap buffer size.\nConsequently, when the muxer proceeds to write the excessive NAL units into the undersized heap allocation, a heap-based buffer overflow occurs. The payload behavior involves writing out-of-bounds memory structures, corrupting adjacent heap metadata or critical application data structures. Attack flow initiates when a user or automated system processes a malicious HEVC file via FFmpeg or an application embedding the vulnerable FFmpeg libraries.\nThe muxing operation parses the HEVC stream, encounters the maliciously inflated NAL unit counts, overflows the internal tracking and allocation counters, and subsequently writes beyond the boundaries of the heap buffer during the hvcC box generation. Affected versions encompass all FFmpeg codebases prior to commit acf5d7c. Authentication and privilege requirements are typically non-existent from an internal exploitation perspective, as the flaw is triggered entirely through parsing untrusted input data. Network exposure depends on the architecture of the application utilizing FFmpeg, but web services, media transcoders, and ingestion pipelines processing external video uploads are at elevated risk. Post-exploitation impact can range from immediate process termination due to heap corruption detection to arbitrary code execution within the context of the running media processing service."
}