Description

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size. On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check. This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-19T17:21:12.863Z",
  "pubdate": "2026-08-19T17:21:12.863Z",
  "executiveSummary": "An incorrect integer narrowing conversion vulnerability exists within the AV1 RTP packetizer of FFmpeg before commit b4c199c. The flaw specifically resides in the libavformat/rtpenc_av1.c source file during the processing of Open Bitstream Unit (OBU) sizes.\nThe vulnerability allows an attacker to supply a sufficiently large OBU size value that undergoes a sign-flipping operation when cast to a 32-bit long integer on targeted platforms, such as 64-bit Windows. This transformation bypasses safety bounds and payload size verification checks.\nSuccessful exploitation of this flaw leads to out-of-bounds memory access when the oversized and unvalidated value is subsequently utilized as a copy length during packetization operations.\nThe impact includes potential memory corruption, application crashes, and arbitrary code execution depending on heap layout and memory management protections on the affected system.\nRisk implications are significant for applications processing untrusted AV1 streams over RTP networks using vulnerable builds of FFmpeg on platforms where long integers are 32 bits.\nAttacker capabilities involve crafting malicious RTP streams containing oversized OBU payloads designed to trigger the integer narrowing conversion and subsequent out-of-bounds memory read or write operations.",
  "technicalDetails": "The root cause of the vulnerability is an incorrect integer narrowing conversion located in the AV1 RTP packetizer component, specifically within the libavformat/rtpenc_av1.c file of FFmpeg.\nDuring the RTP packetization process for AV1 streams, the size of an Open Bitstream Unit (OBU) is cast to a long integer prior to being compared against the remaining frame size to ensure safety boundaries are respected.\nOn target architectures and operating systems where the long data type is 32 bits—notably including 64-bit Windows environments—sufficiently large OBU size values are sign-flipped by this narrowing cast. This conversion turns a large positive integer into a negative value.\nBecause the resulting value is negative, it erroneously passes the subsequent payload size check and security bounds validation.\nThe attack flow proceeds as follows: An attacker transmits a malformed or maliciously crafted AV1 RTP packet featuring an oversized OBU. FFmpeg parses the packet via the vulnerable rtpenc_av1.c logic. The OBU size undergoes the faulty cast to a 32-bit long integer, bypassing the safety check due to sign-flipping. The oversized OBU value is subsequently accepted and used as a copy length parameter in memory operations.\nThe payload behavior results in out-of-bounds memory access when data of the oversized length is copied or processed, directly corrupting adjacent memory regions.\nThe affected versions include all FFmpeg codebases prior to commit b4c199c. The component involved is the AV1 RTP packetizer in libavformat/rtpenc_av1.c.\nNetwork exposure applies to any service, application, or media player utilizing the vulnerable FFmpeg library to ingest, process, or stream AV1 over RTP. Authentication and privilege requirements depend on the specific application architecture handling the network streams, but remote exploitation via untrusted network inputs is feasible."
}