CVE-2026-75142

FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c

Published Aug 19, 2026 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Description

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.

Analysis

Technical impact

FFmpeg versions prior to commit 9d786e4 contain a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When an input file is parsed that contains more streams than the muxer's fixed-size stack buffer can hold, the overflow occurs during the creation of the MPEG-PS file header. This flaw can be triggered by an attacker who owns or controls the input file, allowing arbitrary code execution or denial of service if the overflow corrupts critical data structures. The weakness corresponds to an unchecked buffer write (CWE-120 and CWE-121).

Affected Systems

The vulnerability impacts the FFmpeg project, affecting all binaries built from source before the commit that introduces the fix (9d786e4b5e9b8482651928574de33772aeee7be1). Users of pre-release or older stable releases should verify the used version. The vulnerability specifically pertains to the MPEG-PS muxer component of FFmpeg.

Risk and Exploitability

The CVSS base score is 8.5, indicating a high severity. The EPSS score is less than 1%, indicating a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a crafted media file that contains an excessive number of streams; when ffmpeg processes this file, the stack buffer overflows. The flaw affects the integrity of the program’s execution environment, and an attacker who can provide such a file to ffmpeg can gain local code execution on the host running the process.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FFmpeg

unaffected

Version	Status	Constraints
`0`	affected	< 9d786e4b5e9b8482651928574de33772aeee7be1

No data.

Vendor Product Versions

Ffmpeg

Version	Status	Scheme	Platform
`[0,9d786e4b5e9b8482651928574de33772aeee7be1)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update FFmpeg to a release that includes the commit after 9d786e4b5e9b8482651928574de33772aeee7be1.
Prior to launching ffmpeg, perform a sanity check on the input file to ensure the number of media streams does not exceed the tool’s documented limits, or use a wrapper script to enforce a maximum stream count.
If upgrading immediately is impractical, execute ffmpeg within a sandboxed or containerized environment and ensure that untrusted media files are processed in isolation from critical system resources.

Generated by OpenCVE AI on August 28, 2026 at 19:56 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8716-2	FFmpeg vulnerabilities

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.138% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087
https://nvd.nist.gov/vuln/detail/CVE-2026-75142
https://www.cve.org/CVERecord?id=CVE-2026-75142
https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c

History

Oct 27, 2026 10:30 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:ffmpeg:ffmpeg:-:::::::*

Aug 28, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-120
References		https://nvd.nist.gov/vuln/detail/CVE-2026-75142 https://www.cve.org/CVERecord?id=CVE-2026-75142
Metrics	threat_severity `None`	threat_severity `Important`

Aug 27, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 19, 2026 6:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Ffmpeg Ffmpeg ffmpeg
Vendors & Products		Ffmpeg Ffmpeg ffmpeg

Aug 19, 2026 4:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.
Title		FFmpeg Stack Buffer Overflow in MPEG-PS Muxer via mpegenc.c
Weaknesses		CWE-121
References		https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9d786e4b5e9b8482651928574de33772aeee7be1 https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24087 https://www.vulncheck.com/advisories/ffmpeg-stack-buffer-overflow-in-mpeg-ps-muxer-via-mpegenc-c
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`