FFmpeg contains a heap buffer overflow in the VC-2/Dirac RTP packetizer. When a crafted Dirac data unit or fragment size is packetized, the code copies the input‑derived size into a fixed‑size buffer without an upper bound check. The overflow can corrupt heap memory and potentially allow attackers to execute arbitrary code or crash the process.

The vulnerability affects all FFmpeg releases prior to commit 1cdeb3c. It is present in the libavformat/rtpenc_vc2hq.c component, which processes Dirac media streams for RTP output.

The risk is high, with a CVSS score of 8.5. An EPSS score of <1% indicates a low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The lack of bounds checking makes exploitation likely in environments that accept untrusted Dirac input. The attack vector is likely from an attacker supplying a specially crafted Dirac data unit to the packetizer; this can be performed remotely if the affected FFmpeg instance is exposed to external media streams.