Description

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T17:21:13.057Z",
  "pubdate": "2026-08-19T17:21:13.057Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in FFmpeg before commit 65b0dab within the DASH demuxer implementation located at libavformat/dashdec.c.\nThe vulnerability is triggered when processing a live DASH manifest that is refreshed with a startNumber lower than the previously recorded value.\nThis condition causes the current sequence number to be driven negative, and because the fragment retrieval function only validates the upper bound before indexing the fragments array, a negative index is used.\nAn attacker controlling a malicious or misconfigured DASH server can exploit this flaw by serving a crafted live manifest with a decreasing startNumber across a refresh cycle.\nSuccessful exploitation can lead to an out-of-bounds read, resulting in application crashes, denial of service, or potentially unauthorized memory disclosure depending on the surrounding memory layout and architecture.\nNo specific authentication or high-level privileges are required by the client processing the stream, as the attack is mediated via network exposure to the untrusted DASH server providing the malicious manifest data.",
  "technicalDetails": "The root cause of the vulnerability resides in the fragment indexing logic within the DASH demuxer implemented in libavformat/dashdec.c.\nDuring the parsing and handling of live DASH streams, clients periodically refresh the DASH manifest to track newly available media fragments.\nThe internal state maintains a sequence number and a startNumber derived from the manifest parameters.\nWhen a live DASH manifest is maliciously or erroneously crafted to feature a startNumber that is lower than the previous value, the internal sequence calculations drive the current sequence number into a negative integer state.\nPrior to the fix introduced in commit 65b0dab, the fragment retrieval function implemented insufficient boundary checks.\nSpecifically, the validation logic exclusively verified the upper bound of the target index against the size of the fragments array, entirely omitting validation for lower-bound safety.\nConsequently, when the fragment retrieval function attempts to resolve a fragment using the negative sequence number as an array index, it bypasses safety checks and accesses memory preceding the allocated fragments array.\nThe step-by-step attack flow begins when a client connects to a malicious or compromised DASH server and initiates playback of a live stream.\nInitially, the server provides a standard, valid manifest establishing a baseline startNumber.\nDuring a subsequent manifest refresh interval, the server serves a modified manifest containing a substantially lower startNumber.\nThe parser processes this update, causing the internal sequence tracker to decrement into a negative integer value.\nWhen the client attempts to retrieve the next media fragment based on this updated sequence state, the vulnerable bounds-checking logic fails to intercept the negative value.\nThe negative index is passed directly to the array indexing operation in libavformat/dashdec.c.\nThis prompts an out-of-bounds memory read operation, destabilizing the FFmpeg execution context.\nDepending on the consuming application's architecture and error handling, this memory corruption vector results in an immediate denial of service via application crash or potentially exposes adjacent heap or stack data."
}