Description

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-19T17:21:12.720Z",
  "pubdate": "2026-08-19T17:21:12.720Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists in the VC-2/Dirac RTP packetizer of FFmpeg before commit 1cdeb3c. The flaw arises due to the lack of an upper bound check when copying an input-derived data unit or fragment size into a fixed-size buffer during the RTP packetization process.\nAn attacker capable of supplying a specially crafted Dirac data unit to the vulnerable FFmpeg instance can trigger severe memory corruption. This vulnerability impacts systems utilizing FFmpeg for processing and packetizing VC-2/Dirac video streams over RTP protocols.\nSuccessful exploitation of this memory corruption vulnerability can potentially lead to arbitrary code execution, denial of service through application crashes, or unpredictable runtime behavior depending on the heap layout and attacker-controlled payload data.\nThe attack requires the victim or an automated service to process malicious input data using the affected RTP packetizer module. No specific authentication or privilege requirements are explicitly detailed beyond the capability to supply or stream the crafted data unit into the processing pipeline.",
  "technicalDetails": "The vulnerability resides within the VC-2/Dirac RTP packetization implementation located at libavformat/rtpenc_vc2hq.c in FFmpeg before commit 1cdeb3c.\nThe root cause of the vulnerability is the absence of rigorous bounds checking when processing input data. Specifically, the packetization logic copies an input-derived data unit or fragment size directly into a fixed-size destination buffer allocated on the heap.\nWhen a crafted Dirac data unit containing an excessively large size value is supplied, the copy operation exceeds the boundaries of the fixed-size buffer, resulting in a heap buffer overflow.\nThe step-by-step attack flow proceeds as follows: First, the attacker crafts a malicious Dirac data unit with a manipulated size descriptor. Second, the target system utilizes FFmpeg to process this input and invokes the VC-2/Dirac RTP packetizer function in libavformat/rtpenc_vc2hq.c. Third, during the packetization routine, the component reads the input-derived size without validating it against the remaining capacity of the destination heap buffer. Fourth, the memory copy routine writes beyond the allocated buffer boundaries, corrupting adjacent heap structures.\nThe affected component is exposed over network protocols when FFmpeg is configured to packetize and stream VC-2/Dirac video over RTP. Depending on the architecture and application context, this can expose network services or media processing pipelines to remote or local exploitation.\nPost-exploitation impact includes memory corruption that can compromise the integrity and availability of the host process, potentially escalating to arbitrary code execution under the security context of the user running the FFmpeg process."
}