CVE-2026-75144

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 1cdeb3c

Description A heap buffer overflow exists in the VC-2/Dirac RTP packetizer within the libavformat/rtpenc vc2hq.c file. The issue occurs because the packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without performing an upper bound check. An attacker can trigger memory corruption by supplying a specially crafted Dirac data unit during the process of packetizing input for RTP output.

Recommendations Update FFmpeg to the version containing commit 1cdeb3c or later.