CVE-2026-75147

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 983dae9

Description An out-of-bounds read exists in the AV1 RTP packetizer within the libavformat/rtpenc av1.c file. The issue occurs during the keyframe detection loop when searching for a sequence header OBU (Open Bitstream Unit). The process advances the pointer and remaining-size counter by the encoded header length and OBU payload size without verifying if the OBU size exceeds the remaining data. A specially crafted OBU size can cause the remaining-size counter to wrap to a positive value, leading the subsequent loop iteration to dereference a pointer beyond the packet buffer boundary. This can be triggered by a crafted AV1 input packet muxed to RTP.

Recommendations Update FFmpeg to commit 983dae9 or a later version.