Description

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-19T17:21:12.437Z",
  "pubdate": "2026-08-19T17:21:12.437Z",
  "executiveSummary": "A stack buffer overflow vulnerability exists in the MPEG-PS muxer component of FFmpeg, specifically within the file libavformat/mpegenc.c, affecting versions prior to commit 9d786e4.\nThe vulnerability is triggered when processing input streams that exceed the capacity of the muxer's fixed-size stack buffer.\nAn attacker can exploit this flaw by supplying a crafted input file containing an excessive number of streams, leading to memory corruption during the MPEG-PS muxing process.\nThe primary impact of this vulnerability includes potential arbitrary code execution, denial of service, and application crashes depending on the memory layout and compiler protections present on the target system.\nThis vulnerability presents significant risk implications for systems automatically processing untrusted media files, potentially allowing attackers to compromise the underlying host processing the data.\nExploitation requires the victim to process a specially crafted media file with an excessive stream count, meaning the attack capability is contingent on tricking a user or automated service into muxing malicious input.",
  "technicalDetails": "The root cause of the vulnerability resides in a fixed-size stack buffer allocated within the MPEG-PS muxer implementation located in libavformat/mpegenc.c.\nWhen the muxer prepares to write output streams, it fails to adequately validate or bound the total number of input streams against the static dimensions of the internal stack-allocated buffer.\nThe attack flow begins when an attacker crafts a malicious input file containing an artificially inflated number of streams.\nWhen FFmpeg attempts to mux this crafted input into the MPEG-PS format, the routine responsible for tracking or storing stream references writes past the boundary of the fixed-size stack buffer.\nThis out-of-bounds write overwrites adjacent stack memory, which can corrupt saved frame pointers, return addresses, or local variables.\nDepending on the exact memory contents overwritten, the payload behavior manifests as an immediate segmentation fault causing denial of service, or potentially controlled redirection of execution flow if the overwritten return address points to attacker-controlled shellcode or utilizes return-oriented programming (ROP) chains.\nThe vulnerable component is explicitly the MPEG-PS muxer within libavformat/mpegenc.c.\nAffected versions include all FFmpeg commits prior to 9d786e4.\nAuthentication and privilege requirements are typically non-existent at the application layer, as the flaw is triggered entirely through the processing of untrusted input data passed to the multimedia framework.\nNetwork exposure depends on the architecture of the application utilizing FFmpeg; services that accept remote media uploads or stream transcoding over the network inherit this exposure directly."
}