CVE-2026-30754
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the...
CVE-2026-30754 is a high vulnerability (CVSS 8.8) in Ffmpeg, published September 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in ffmpeg 7:5.1.8-0+deb12u1.
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
- Record
CVE-2026-30754- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-74264
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
- Record
EUVD-2026-74264- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-crqp-42h3-7fcv
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the...
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
- Record
GHSA-crqp-42h3-7fcv- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
- Record
CVE-2026-30754- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
- Record
CVE-2026-30754- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-30754
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
- Record
DEBIAN-CVE-2026-30754- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVOESA-2026-4144
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.(CVE-2026-30754)
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.(CVE-2026-52296)
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.(CVE-2026-90815)
- Record
OESA-2026-4144- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4145
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.(CVE-2026-30754)
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.(CVE-2026-52296)
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.(CVE-2026-90815)
- Record
OESA-2026-4145- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4146
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.(CVE-2026-30754)
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.(CVE-2026-52296)
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.(CVE-2026-90815)
- Record
OESA-2026-4146- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-4147
ffmpeg security update
FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.
Security Fix(es):
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.(CVE-2026-30754)
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.(CVE-2026-52296)
A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component.(CVE-2026-90815)
- Record
OESA-2026-4147- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-30754
A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.
- Record
UBUNTU-CVE-2026-30754- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-8915-1 No score
ffmpeg vulnerabilities
Momoko Shiraishi discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-30754)
It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-38344)
It was discovered that FFmpeg did not correctly handle certain arithmetic operations. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-38346, CVE-2026-38348, CVE-2026-38349)
It was discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-38347)
It was discovered that FFmpeg did not correctly handle certain arithmetic operations. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-38350)
Joshua Rogers discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-75147)
- Record
USN-8915-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ffmpegDebian:12 |
before 7:5.1.8-0+deb12u1, plus listed versions 7:5.1.3-17:5.1.3-27:5.1.4-0+deb12u17:5.1.5-0+deb12u17:5.1.6-0+deb12u17:5.1.7-0+deb12u1 |
7:5.1.8-0+deb12u1 |
ffmpegDebian:13 |
before 7:7.1.3-0+deb13u1, plus listed versions 7:7.1.1-17:7.1.2-0+deb13u17:7.1.2-1 |
7:7.1.3-0+deb13u1 |
ffmpegDebian:14 |
before 7:8.0.1-2, plus listed versions 7:7.1.1-17:7.1.2-17:7.1.3-17:8.0-17:8.0-27:8.0.1-1 |
7:8.0.1-2 |
ffmpegopenEuler:22.03-LTS-SP4 |
before 4.2.4-57.oe2203sp4 | 4.2.4-57.oe2203sp4 |
ffmpegopenEuler:24.03-LTS-SP1 |
before 6.1.1-52.oe2403sp1 | 6.1.1-52.oe2403sp1 |
ffmpegopenEuler:24.03-LTS-SP3 |
before 6.1.1-52.oe2403sp3 | 6.1.1-52.oe2403sp3 |
ffmpegopenEuler:24.03-LTS-SP4 |
before 6.1.1-52.oe2403sp4 | 6.1.1-52.oe2403sp4 |
libavUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 6:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu6 Show 9 moreShow less6:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.16:9.16-0ubuntu0.14.04.16:9.18-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.16:9.20-0ubuntu0.14.04.1+esm1 |
None known |
ffmpegUbuntu:Pro:16.04:LTS |
before 7:2.8.17-0ubuntu0.1+esm18, plus listed versions 7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.2-1ubuntu17:2.8.3-17:2.8.4-1 Show 30 moreShow less7:2.8.4-1ubuntu17:2.8.4-1ubuntu27:2.8.4-1ubuntu37:2.8.4-1ubuntu47:2.8.6-1ubuntu17:2.8.6-1ubuntu27:2.8.8-0ubuntu0.16.04.17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm27:2.8.17-0ubuntu0.1+esm37:2.8.17-0ubuntu0.1+esm47:2.8.17-0ubuntu0.1+esm57:2.8.17-0ubuntu0.1+esm67:2.8.17-0ubuntu0.1+esm77:2.8.17-0ubuntu0.1+esm87:2.8.17-0ubuntu0.1+esm97:2.8.17-0ubuntu0.1+esm107:2.8.17-0ubuntu0.1+esm117:2.8.17-0ubuntu0.1+esm127:2.8.17-0ubuntu0.1+esm137:2.8.17-0ubuntu0.1+esm147:2.8.17-0ubuntu0.1+esm157:2.8.17-0ubuntu0.1+esm167:2.8.17-0ubuntu0.1+esm17 |
7:2.8.17-0ubuntu0.1+esm18 |
ffmpegUbuntu:Pro:18.04:LTS |
before 7:3.4.11-0ubuntu0.1+esm16, plus listed versions 7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build1 Show 24 moreShow less7:3.4.1-17:3.4.1-1build17:3.4.2-17:3.4.2-1build17:3.4.2-27:3.4.4-0ubuntu0.18.04.17:3.4.6-0ubuntu0.18.04.17:3.4.8-0ubuntu0.27:3.4.11-0ubuntu0.17:3.4.11-0ubuntu0.1+esm17:3.4.11-0ubuntu0.1+esm27:3.4.11-0ubuntu0.1+esm37:3.4.11-0ubuntu0.1+esm47:3.4.11-0ubuntu0.1+esm57:3.4.11-0ubuntu0.1+esm67:3.4.11-0ubuntu0.1+esm77:3.4.11-0ubuntu0.1+esm87:3.4.11-0ubuntu0.1+esm97:3.4.11-0ubuntu0.1+esm107:3.4.11-0ubuntu0.1+esm117:3.4.11-0ubuntu0.1+esm127:3.4.11-0ubuntu0.1+esm137:3.4.11-0ubuntu0.1+esm147:3.4.11-0ubuntu0.1+esm15 |
7:3.4.11-0ubuntu0.1+esm16 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ffmpegUbuntu:Pro:20.04:LTS |
before 7:4.2.7-0ubuntu0.1+esm18, plus listed versions 7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu1 Show 20 moreShow less7:4.2.4-1ubuntu0.17:4.2.4-1ubuntu0.1+esm17:4.2.7-0ubuntu0.17:4.2.7-0ubuntu0.1+esm17:4.2.7-0ubuntu0.1+esm27:4.2.7-0ubuntu0.1+esm37:4.2.7-0ubuntu0.1+esm47:4.2.7-0ubuntu0.1+esm57:4.2.7-0ubuntu0.1+esm67:4.2.7-0ubuntu0.1+esm77:4.2.7-0ubuntu0.1+esm87:4.2.7-0ubuntu0.1+esm97:4.2.7-0ubuntu0.1+esm107:4.2.7-0ubuntu0.1+esm117:4.2.7-0ubuntu0.1+esm127:4.2.7-0ubuntu0.1+esm137:4.2.7-0ubuntu0.1+esm147:4.2.7-0ubuntu0.1+esm157:4.2.7-0ubuntu0.1+esm167:4.2.7-0ubuntu0.1+esm17 |
7:4.2.7-0ubuntu0.1+esm18 |
ffmpegUbuntu:Pro:22.04:LTS |
before 7:4.4.2-0ubuntu0.22.04.1+esm17, plus listed versions 7:4.4-6ubuntu57:4.4.1-2ubuntu17:4.4.1-3ubuntu17:4.4.1-3ubuntu27:4.4.1-3ubuntu3 Show 18 moreShow less7:4.4.1-3ubuntu57:4.4.2-0ubuntu0.22.04.17:4.4.2-0ubuntu0.22.04.1+esm17:4.4.2-0ubuntu0.22.04.1+esm27:4.4.2-0ubuntu0.22.04.1+esm37:4.4.2-0ubuntu0.22.04.1+esm47:4.4.2-0ubuntu0.22.04.1+esm57:4.4.2-0ubuntu0.22.04.1+esm67:4.4.2-0ubuntu0.22.04.1+esm77:4.4.2-0ubuntu0.22.04.1+esm87:4.4.2-0ubuntu0.22.04.1+esm97:4.4.2-0ubuntu0.22.04.1+esm107:4.4.2-0ubuntu0.22.04.1+esm117:4.4.2-0ubuntu0.22.04.1+esm127:4.4.2-0ubuntu0.22.04.1+esm137:4.4.2-0ubuntu0.22.04.1+esm147:4.4.2-0ubuntu0.22.04.1+esm157:4.4.2-0ubuntu0.22.04.1+esm16 |
7:4.4.2-0ubuntu0.22.04.1+esm17 |
ffmpegUbuntu:Pro:24.04:LTS |
before 7:6.1.1-3ubuntu5+esm15, plus listed versions 7:6.0-6ubuntu17:6.0-9ubuntu17:6.1-2ubuntu17:6.1-3ubuntu17:6.1-4ubuntu1 Show 16 moreShow less7:6.1-5ubuntu17:6.1.1-1ubuntu17:6.1.1-3ubuntu17:6.1.1-3ubuntu57:6.1.1-3ubuntu5+esm17:6.1.1-3ubuntu5+esm27:6.1.1-3ubuntu5+esm37:6.1.1-3ubuntu5+esm47:6.1.1-3ubuntu5+esm57:6.1.1-3ubuntu5+esm67:6.1.1-3ubuntu5+esm77:6.1.1-3ubuntu5+esm87:6.1.1-3ubuntu5+esm107:6.1.1-3ubuntu5+esm117:6.1.1-3ubuntu5+esm127:6.1.1-3ubuntu5+esm13 |
7:6.1.1-3ubuntu5+esm15 |
ffmpegUbuntu:Pro:26.04:LTS |
before 7:8.0.1-3ubuntu2+esm5, plus listed versions 7:7.1.1-1ubuntu47:7.1.2-1ubuntu37:7.1.2-1ubuntu47:7.1.3-1ubuntu17:8.0.1-2ubuntu1 Show 5 moreShow less7:8.0.1-3ubuntu17:8.0.1-3ubuntu27:8.0.1-3ubuntu2+esm17:8.0.1-3ubuntu2+esm37:8.0.1-3ubuntu2+esm4 |
7:8.0.1-3ubuntu2+esm5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746
github.com/momo-trip/poc_ffmpeg
gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6
nvd.nist.gov/vuln/detail/CVE-2026-30754
Show 17 moreShow less
security-tracker.debian.org/tracker/CVE-2026-30754
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4144
ubuntu.com/security/CVE-2026-30754
cve.org/CVERecord?id=CVE-2026-30754