The AV1 RTP packetizer in FFmpeg performs an improper integer narrowing conversion when comparing the size of an AV1 OBU against the remaining frame size. On platforms where the C type long is 32 bits, the conversion sign‑extends large OBU sizes to a negative value that passes the payload size check. This flaw allows an attacker to send an oversized OBU within a crafted RTP packet; the unchecked copy length then results in out‑of‑bounds memory access, which could corrupt memory, crash the process or be leveraged to gain arbitrary code execution. The weakness is identified by CWE‑681: Incorrect conversion between data types.

FFmpeg software distributed as the libavformat/rtpenc_av1 component is affected. Any FFmpeg build that contains a code path prior to the commit b4c199c5906ff53368926c2a5839881f41957e7f is vulnerable. The vulnerability is present on systems where the long type is 32 bits, including 64‑bit Windows, but is not reported on platforms where long is 64 bits. Therefore, FFmpeg installations on Windows, Linux, macOS, and other operating systems that compile the library with a 32‑bit long should be considered vulnerable until the fix is applied.

The CVSS score of 5.8 indicates a moderate impact if exploited. Because the EPSS score is not available, the exact likelihood of real‑world exploitation cannot be quantified, but the flaw offers a predictable memory corruption path that an attacker might leverage in a controlled environment that receives AV1 RTP streams. The flaw is not currently listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Nonetheless, the vulnerability could be triggered remotely over the network by delivering a malicious RTP packet, so the potential for a remote exploit exists on affected builds.