Bug 2519758 (CVE-2026-75143) - CVE-2026-75143 ffmpeg: FFmpeg Heap Buffer Overflow via RIST Protocol Reader
Summary: CVE-2026-75143 ffmpeg: FFmpeg Heap Buffer Overflow via RIST Protocol Reader
Keywords:
Status: NEW
Alias: CVE-2026-75143
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2526158 2526159
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-19 16:53 UTC by OSIDB Bzimport
Modified: 2026-08-31 08:12 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-19 16:53:18 UTC
FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.


Note You need to log in before you can comment on or make changes to this bug.