Heap-based Buffer Overflow in FFmpeg hvcC Box Writer

A heap-based buffer overflow vulnerability (CVE-2026-75141) exists in the FFmpeg media processing library, specifically within the hvcC (HEVC configuration record) box writer. The vulnerability is triggered when processing an HEVC file that contains an excessive number of Network Abstraction Layer (NAL) units of a single type, exceeding the capacity of the internal count field. This integer overflow results in a heap-based buffer overflow during the muxing process. An attacker can leverage this flaw by providing a specially crafted HEVC file to an application that utilizes affected versions of FFmpeg. Successful exploitation could allow for arbitrary code execution or cause an application crash. Given FFmpeg's ubiquity in media transcoding pipelines, software players, and web-based processing services, this vulnerability poses a significant risk to any environment that processes untrusted video input.

Attack Chain

1. Attacker crafts a malicious HEVC video file containing an oversized count of specific NAL units.
2. Attacker identifies a target application or service that utilizes the affected FFmpeg library for media processing.
3. The target application receives the malicious HEVC file via upload, network stream, or file system access.
4. The application passes the malicious file to the FFmpeg library for muxing or transcoding operations.
5. The hvcC box writer component within FFmpeg attempts to process the HEVC configuration record.
6. The integer overflow occurs during the calculation of the NAL unit count, leading to an incorrect buffer size allocation.
7. Writing the configuration record triggers a heap-based buffer overflow, overwriting adjacent memory.
8. Final objective is achieved, resulting in either a denial of service (crash) or potentially arbitrary code execution within the context of the target application.

Impact

The vulnerability allows an attacker to achieve arbitrary code execution or denial of service on systems processing crafted HEVC content. Given the widespread integration of FFmpeg into multimedia applications, content management systems, and transcoding servers, this represents a significant security risk for any organization handling user-supplied media files.

Recommendation

• Patch FFmpeg by updating to or beyond commit acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781.
• Audit applications within the environment that utilize FFmpeg for video processing and ensure they are compiled against or linked to the patched library version.
• Implement strict input validation and sandboxing for media processing pipelines to mitigate risks from processing untrusted HEVC files.