---
id: CVE-2026-75144
title: FFmpeg Heap Buffer Overflow in VC-2/Dirac RTP Packetizer
summary: >-
  FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in
  the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows
  attackers to trigger memory corruption by supplying a crafted Dirac data unit.
  The packe…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-122
vendor: FFmpeg
product: FFmpeg
affected:
  - FFmpeg < 1cdeb3c4e7f1f8566d846b9b451e01c376398818
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-08-20T00:00:00+00:00'
published: '2026-08-19'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T10:14:31.556Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-75144'
references:
  - url: 'https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24091'
    label: Pull Request
  - url: >-
      https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1cdeb3c4e7f1f8566d846b9b451e01c376398818
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-in-vc-2-dirac-rtp-packetizer
tags:
  - cve.org
epss: 0.00199
epssPercentile: 0.09654
ingestedAt: '2026-10-27T16:11:59.276Z'
---

## Overview

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copies an input-derived data unit or fragment size into a fixed-size buffer without an upper bound check, causing a heap buffer overflow when the crafted input is packetized for RTP output.

## Affected

- `FFmpeg < 1cdeb3c4e7f1f8566d846b9b451e01c376398818`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.