{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ffmpeg--65b0dab/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-75141"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FFmpeg","FFmpeg (\u003c 1cdeb3c)","FFmpeg (\u003c 65b0dab)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","memory-corruption","ffmpeg","memory-safety"],"_cs_type":"advisory","_cs_vendors":["FFmpeg"],"content_html":"\u003cp\u003eA heap-based buffer overflow vulnerability (CVE-2026-75141) exists in the FFmpeg media processing library, specifically within the hvcC (HEVC configuration record) box writer. The vulnerability is triggered when processing an HEVC file that contains an excessive number of Network Abstraction Layer (NAL) units of a single type, exceeding the capacity of the internal count field. This integer overflow results in a heap-based buffer overflow during the muxing process. An attacker can leverage this flaw by providing a specially crafted HEVC file to an application that utilizes affected versions of FFmpeg. Successful exploitation could allow for arbitrary code execution or cause an application crash. Given FFmpeg's ubiquity in media transcoding pipelines, software players, and web-based processing services, this vulnerability poses a significant risk to any environment that processes untrusted video input.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious HEVC video file containing an oversized count of specific NAL units.\u003c/li\u003e\n\u003cli\u003eAttacker identifies a target application or service that utilizes the affected FFmpeg library for media processing.\u003c/li\u003e\n\u003cli\u003eThe target application receives the malicious HEVC file via upload, network stream, or file system access.\u003c/li\u003e\n\u003cli\u003eThe application passes the malicious file to the FFmpeg library for muxing or transcoding operations.\u003c/li\u003e\n\u003cli\u003eThe hvcC box writer component within FFmpeg attempts to process the HEVC configuration record.\u003c/li\u003e\n\u003cli\u003eThe integer overflow occurs during the calculation of the NAL unit count, leading to an incorrect buffer size allocation.\u003c/li\u003e\n\u003cli\u003eWriting the configuration record triggers a heap-based buffer overflow, overwriting adjacent memory.\u003c/li\u003e\n\u003cli\u003eFinal objective is achieved, resulting in either a denial of service (crash) or potentially arbitrary code execution within the context of the target application.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an attacker to achieve arbitrary code execution or denial of service on systems processing crafted HEVC content. Given the widespread integration of FFmpeg into multimedia applications, content management systems, and transcoding servers, this represents a significant security risk for any organization handling user-supplied media files.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch FFmpeg by updating to or beyond commit acf5d7cdc1f9ae8752c23e1ea8d7f355ed780781.\u003c/li\u003e\n\u003cli\u003eAudit applications within the environment that utilize FFmpeg for video processing and ensure they are compiled against or linked to the patched library version.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sandboxing for media processing pipelines to mitigate risks from processing untrusted HEVC files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T18:38:52Z","date_published":"2026-08-19T18:38:30Z","id":"https://feed.craftedsignal.io/briefs/2026-08-ffmpeg-heap-overflow/","summary":"FFmpeg versions prior to commit acf5d7c contain a heap-based buffer overflow in the hvcC box writer that can be triggered during HEVC file muxing, potentially leading to arbitrary code execution.","title":"Heap-based Buffer Overflow in FFmpeg hvcC Box Writer","url":"https://feed.craftedsignal.io/briefs/2026-08-ffmpeg-heap-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - FFmpeg (\u003c 65b0dab)","version":"https://jsonfeed.org/version/1.1"}