CVE Watch8 sept 2026

CVE-2026-30754

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 8 sept 2026 · Última mod.: 8 sept 2026

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.

Referencias oficiales

code.ffmpeg.orghttps://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746
gist.github.comhttps://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6
github.comhttps://github.com/momo-trip/poc_ffmpeg

CVEs relacionados

Sin CVEs relacionados por CWE o producto.