CVE-2026-75144 FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer
Attackers can trigger heap buffer overflow and potential code execution in FFmpeg by supplying crafted Dirac data units to the RTP packetizer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-75144?
CVE-2026-75144 is a high-severity memory corruption vulnerability in FFmpeg, published on 19 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.
Weakness: CWE-122
Which versions are affected by CVE-2026-75144?
How do I fix CVE-2026-75144?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-75144 being exploited?
There is no known exploitation of CVE-2026-75144 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-75144, ECHO-d43d-3438-b69f, GHSA-mg5r-49w7-j3cv, UBUNTU-CVE-2026-75144.