CVE-2026-75146

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093
https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) FFmpeg antes del commit 65b0dab contiene una lectura fuera de límites en el demuxer DASH (libavformat/dashdec.c). Cuando un manifiesto DASH en vivo se actualiza con un startNumber que es menor que el valor anterior, el número de secuencia actual se vuelve negativo. La función de recuperación de fragmentos verificó solo el límite superior antes de indexar el array de fragmentos, permitiendo que se usara un índice negativo y causando una lectura fuera de límites. Un servidor DASH malicioso o mal configurado puede desencadenar esto al servir un manifiesto en vivo con un startNumber decreciente a través de una actualización del manifiesto.

Information

Published : 2026-08-19 17:21

Updated : 2026-10-26 11:10

NVD link : CVE-2026-75146

Mitre link : CVE-2026-75146

CVE.ORG link : CVE-2026-75146

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-75146", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75146", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T14:55:54.873673Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg", "vendor": "FFmpeg", "product": "FFmpeg", "versions": [{"status": "affected", "version": "0", "lessThan": "65b0dab903e5975e036b30ecc58f5935d4f151e0", "versionType": "git"}], "packageURL": "pkg:github/FFmpeg/FFmpeg", "defaultStatus": "unaffected"}]}], "published": "2026-08-19T17:21:13.057", "references": [{"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0", "source": "disclosure@vulncheck.com"}, {"url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}, {"lang": "es", "value": "FFmpeg antes del commit 65b0dab contiene una lectura fuera de l\u00edmites en el demuxer DASH (libavformat/dashdec.c). Cuando un manifiesto DASH en vivo se actualiza con un startNumber que es menor que el valor anterior, el n\u00famero de secuencia actual se vuelve negativo. La funci\u00f3n de recuperaci\u00f3n de fragmentos verific\u00f3 solo el l\u00edmite superior antes de indexar el array de fragmentos, permitiendo que se usara un \u00edndice negativo y causando una lectura fuera de l\u00edmites. Un servidor DASH malicioso o mal configurado puede desencadenar esto al servir un manifiesto en vivo con un startNumber decreciente a trav\u00e9s de una actualizaci\u00f3n del manifiesto."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}