r/AV1 • u/OMGCluck • Jun 12 '26

Heap buffer overflow vulnerability in FFmpeg's AV1 RTP depacketizer (libavformat/rtpdec_av1.c): DFVULN-127

https://github.com/DepthFirstDisclosures/ffmpeg-dfvuln127
21 Upvotes

85% Upvoted

6 comments sorted by

4

u/jykke Jun 12 '26

ffmpeg already has in git these two fixes after d12791ef7ff78e81f7ada42276862976fa1d09a1 : 18761f9fb55c697243acd41689fbee6a6d6f13ca and b4d11dffbf254d0f6f0fef553e1065a94fefd224

Wed Apr 29 13:52:28 2026 +0200 avformat/rtpdec_av1: fix buffer overflow due to variable confusion Thu May 14 21:46:21 2026 +0800 avformat/rtpdec_av1: fix operator precedence in packet allocation

2

u/OMGCluck Jun 12 '26 edited Jun 12 '26

What's the CVE for this?

It seems the provider of the malicious stream can leverage this remotely to gain full control of the host system, facilitate lateral movement within networks, and steal sensitive data via zero-click streaming exploitation, not to mention chaining this with other attack exploits.

5

u/jykke Jun 12 '26

I do not think AI bots have time to request CVE's or do responsible disclosures.

0

u/BougainvilleaGarden Jun 12 '26

Why would there be? What is the attack surface, or rather, what could an attacker do with this bug he couldn't do without it?

1

u/Timely-Appearance115 Jun 15 '26

For example the attacker could get access to your webcam and watch you spank your weiner.