CVE-2026-75143

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089
https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) FFmpeg antes del commit 1c10bcc contiene un desbordamiento de búfer de montón en el lector del protocolo RIST (libavformat/librist.c). librist_read() ignoró su argumento de tamaño y copió la longitud completa de la carga útil recibida en el búfer de destino proporcionado por el llamador, desbordándolo cuando la carga útil excede el tamaño del destino. Esto es alcanzable a través del esquema de URL async:rist://, donde el envoltorio asíncrono suministra un búfer más pequeño que la carga útil recibida. Un remitente RIST remoto puede activar el desbordamiento enviando un paquete cuya carga útil excede el tamaño del búfer del llamador.

Information

Published : 2026-08-19 17:21

Updated : 2026-10-26 11:10

NVD link : CVE-2026-75143

Mitre link : CVE-2026-75143

CVE.ORG link : CVE-2026-75143

JSON object : View

Products Affected

No product.

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-75143", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75143", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg", "vendor": "FFmpeg", "product": "FFmpeg", "versions": [{"status": "affected", "version": "0", "lessThan": "1c10bcc2e17255dacb717a25ab3db142ce390602", "versionType": "git"}], "packageURL": "pkg:github/FFmpeg/FFmpeg", "defaultStatus": "unaffected"}]}], "published": "2026-08-19T17:21:12.577", "references": [{"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602", "source": "disclosure@vulncheck.com"}, {"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}, {"lang": "es", "value": "FFmpeg antes del commit 1c10bcc contiene un desbordamiento de b\u00fafer de mont\u00f3n en el lector del protocolo RIST (libavformat/librist.c). librist_read() ignor\u00f3 su argumento de tama\u00f1o y copi\u00f3 la longitud completa de la carga \u00fatil recibida en el b\u00fafer de destino proporcionado por el llamador, desbord\u00e1ndolo cuando la carga \u00fatil excede el tama\u00f1o del destino. Esto es alcanzable a trav\u00e9s del esquema de URL async:rist://, donde el envoltorio as\u00edncrono suministra un b\u00fafer m\u00e1s peque\u00f1o que la carga \u00fatil recibida. Un remitente RIST remoto puede activar el desbordamiento enviando un paquete cuya carga \u00fatil excede el tama\u00f1o del b\u00fafer del llamador."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}