A heap buffer overflow exists in FFmpeg’s RIST protocol reader, because librist_read ignores the size argument and copies the entire received payload into a caller‑provided buffer. This can overwrite memory when an attacker sends a packet whose payload exceeds the destination buffer, potentially allowing arbitrary code execution.

FFmpeg products that include libavformat/librist.c before commit 1c10bcc2e17255dacb717a25ab3db142ce390602 are affected. All releases that have not applied this commit are vulnerable.

The flaw is scored CVSS 9.3 and has an EPSS of less than 1%, indicating a low, but non‑zero, exploitation probability. It is not listed in CISA KEV. The vulnerability is reachable via the async:rist:// URL scheme, meaning a remote RIST sender on the network can trigger the overflow by sending an oversized payload. The attack vector is network‑based and exploits a fundamental buffer size mis‑check in the library.