CVE-2026-30754

EUVD-2026-74264
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 43.62%
Affected Products (NVD)
VendorProductVersion
ffmpegffmpeg
𝑥
< 8.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ffmpeg
bookworm
7:5.1.9-0+deb12u1
fixed
bookworm (security)
7:5.1.9-0+deb12u1
fixed
forky
7:9.0.2-3
fixed
sid
7:9.0.2-3
fixed
trixie
7:7.1.5-0+deb13u1
fixed
trixie (security)
7:7.1.5-0+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ffmpeg
bionic
Fixed in 7:3.4.11-0ubuntu0.1+esm16
released
focal
Fixed in 7:4.2.7-0ubuntu0.1+esm18
released
jammy
Fixed in 7:4.4.2-0ubuntu0.22.04.1+esm17
released
noble
Fixed in 7:6.1.1-3ubuntu5+esm15
released
resolute
not-affected
stonking
not-affected
xenial
Fixed in 7:2.8.17-0ubuntu0.1+esm18
released
libav
jammy
dne
noble
dne
resolute
dne
stonking
dne
trusty
needs-triage
Common Weakness Enumeration
References
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746
https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6
https://github.com/momo-trip/poc_ffmpeg