Description

FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data. A crafted OBU size causes the remaining-size counter to wrap to a positive value, causing the next loop iteration to dereference a pointer beyond the end of the packet buffer. A crafted AV1 input packet muxed to RTP triggers the out-of-bounds read.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T17:21:13.290Z",
  "pubdate": "2026-08-19T17:21:13.290Z",
  "executiveSummary": "This vulnerability is an out-of-bounds read affecting the AV1 RTP packetizer within the libavformat/rtpenc_av1.c component of FFmpeg prior to commit 983dae9.\nThe flaw allows a remote attacker to trigger an out-of-bounds read by supplying a crafted AV1 input packet muxed to RTP.\nThe root cause stems from improper validation of Open Bitstream Unit (OBU) sizes during the keyframe detection loop, leading to an integer wrap of the remaining-size counter.\nSuccessful exploitation can result in unauthorized memory reading, potentially leading to application crashes or information disclosure depending on how the adjacent memory is handled.\nThe attack requires no authentication or special privileges, but relies on the victim processing a maliciously crafted AV1 RTP stream.",
  "technicalDetails": "The vulnerability resides in the keyframe detection loop within the libavformat/rtpenc_av1.c file of FFmpeg, specifically in the AV1 RTP packetizer.\nDuring the processing of AV1 bitstreams for RTP encapsulation, the component searches for a sequence header OBU.\nThe root cause of the vulnerability is the lack of proper bounds checking on the OBU size against the remaining data buffer before updating pointers.\nSpecifically, the parser advances its internal pointer and remaining-size counter by the sum of the encoded header length and the OBU payload size without verifying that the OBU size does not exceed the remaining buffer length.\nWhen a crafted OBU size is supplied, it causes the remaining-size counter to wrap around to a positive value due to integer underflow or arithmetic wrapping.\nBecause the remaining-size counter incorrectly indicates valid data remains, the next iteration of the loop causes the pointer to dereference memory locations beyond the actual end of the packet buffer, resulting in an out-of-bounds read.\nThe attack flow begins when an attacker transmits a maliciously crafted AV1 input packet intended for RTP streaming or muxing.\nWhen FFmpeg processes this crafted packet, the vulnerable AV1 RTP packetizer component parses the malformed OBU structure.\nThe lack of bounds checking triggers the integer wrap condition, leading to the out-of-bounds memory dereference.\nThe attack vector is network-based, as it involves processing untrusted AV1 RTP input streams.\nNo authentication or elevated privileges are required to exploit this vulnerability, as it manifests entirely through the parsing of untrusted media data streams.\nThe impact of successful exploitation includes Denial of Service (DoS) via application crashes or potential exposure of adjacent memory contents."
}