Description

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-19T17:21:12.577Z",
  "pubdate": "2026-08-19T17:21:12.577Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists in FFmpeg prior to commit 1c10bcc within the RIST protocol reader implemented in libavformat/librist.c.\nThe vulnerability is classified as a buffer overflow, which can lead to memory corruption, potential remote code execution, or application crashes.\nAffected systems include FFmpeg installations utilizing the RIST protocol reader and the async wrapper via the async:rist:// URL scheme.\nThe risk implications are severe, as a malicious remote RIST sender can cause arbitrary memory corruption within the context of the running application by transmitting an oversized payload.\nAttacker capabilities require the ability to act as a remote RIST sender communicating with a vulnerable FFmpeg instance that processes a crafted async:rist:// URL.\nExploitation requirements include the victim initiating a connection to the remote RIST sender using the vulnerable asynchronous URL wrapper configuration.",
  "technicalDetails": "The root cause of the vulnerability resides in the librist_read() function located in libavformat/librist.c.\nSpecifically, librist_read() fails to respect its size argument, improperly copying the full received payload length into a caller-provided destination buffer that is smaller than the payload.\nThis mismatch results in a classic heap-based buffer overflow when the incoming network payload exceeds the allocated destination buffer size.\nThe vulnerable component is explicitly the RIST protocol reader within FFmpeg's libavformat library.\nAffected versions comprise all FFmpeg commits prior to the security fix introduced in commit 1c10bcc.\nThe attack vector is network-exposed, reachable via the async:rist:// URL scheme, where the asynchronous wrapper supplies a smaller destination buffer than what the underlying RIST payload actually requires.\nAuthentication and privilege requirements are minimal or non-existent from the perspective of the network stream, as a remote sender interacting with the listening or connecting client can trigger the condition directly.\nDuring the attack flow, a remote RIST sender transmits a crafted network packet containing a payload length that exceeds the buffer size enforced or expected by the caller.\nBecause the vulnerable function ignores the size constraint and performs an unchecked memory copy operation, the incoming data overflows the heap buffer boundaries.\nPost-exploitation impact includes destabilization of the host process, denial of service through application crashes, and potential arbitrary code execution depending on heap layout and memory management protections."
}