CVE-2026-75145

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit b4c199c

Description An incorrect integer narrowing conversion exists in the AV1 RTP packetizer within libavformat/rtpenc av1.c. The OBU (Open Bitstream Unit) size is cast to long before being compared to the remaining frame size. On platforms where long is 32 bits, such as 64-bit Windows, large OBU size values can be sign-flipped, resulting in a negative value that bypasses the payload size check. This allows an oversized OBU to exceed safety bounds, leading to out-of-bounds memory access when the value is used as a copy length.

Recommendations Update FFmpeg to the version containing commit b4c199c or later.