CVE-2026-75143 FFmpeg Heap Buffer Overflow via RIST Protocol Reader
A remote attacker can trigger a heap buffer overflow in FFmpeg's RIST protocol reader by sending oversized packets, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-75143?
CVE-2026-75143 is a critical memory corruption vulnerability in FFmpeg, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.
Weakness: CWE-122
Which versions are affected by CVE-2026-75143?
How do I fix CVE-2026-75143?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-75143 being exploited?
There is no known exploitation of CVE-2026-75143 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-75143, ECHO-a077-2f79-097b, GHSA-7qc3-xqxj-426p, UBUNTU-CVE-2026-75143.