Bug 2519764 (CVE-2026-75146) - CVE-2026-75146 ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer
Summary: CVE-2026-75146 ffmpeg: FFmpeg: Information disclosure and denial of service v...
Keywords:
Status: NEW
Alias: CVE-2026-75146
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2525516 2525517
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-19 16:53 UTC by OSIDB Bzimport
Modified: 2026-08-28 09:14 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-19 16:53:30 UTC
FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh.


Note You need to log in before you can comment on or make changes to this bug.