The AV1 RTP packetizer in FFmpeg performs an improper integer narrowing conversion when comparing the size of an AV1 OBU against the remaining frame size. On platforms where the C type long is 32 bits, the conversion sign‑extends large OBU sizes to a negative value that passes the payload size check. This flaw allows an attacker to send an oversized OBU within a crafted RTP packet; the unchecked copy length then results in out‑of‑bounds memory access, which could corrupt memory, crash the process or be leveraged to gain arbitrary code execution. The weakness is identified by CWE‑681 and CWE‑787: incorrect conversion between data types and potential buffer over‑read issues.

FFmpeg software distributed as the libavformat/rtpenc_av1 component is affected. Any FFmpeg build that contains a code path prior to the commit b4c199c5906ff53368926c2a5839881f41957e7f is vulnerable. The vulnerability is present on systems where the long type is 32 bits, including 64‑bit Windows, but is not reported on platforms where long is 64 bits. Therefore, FFmpeg installations on Windows, Linux, macOS, and other operating systems that compile the library with a 32‑bit long should be considered vulnerable until the fix is applied.

The CVSS score of 5.8 indicates a moderate impact if exploited. With an EPSS score of 0.00117, the likelihood of real‑world exploitation is very low, although the flaw provides a predictable memory corruption path that an attacker might use in a controlled environment receiving AV1 RTP streams. The flaw is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Based on the description, it is inferred that the vulnerability could be triggered remotely by a malicious RTP packet, so the potential for a remote exploit exists on affected builds.