CVE-2026-75143
ffmpeg: FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c)
CVE-2026-75143 is fixed in 38 products on 1 platform, first by ffmpeg 7:8.0.1-3ubuntu2+esm4, released August 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0070
53rd percentile
FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| ffmpeg · Debian 14 | 7:9.0.2-1 | DEBIAN-CVE-2026-75143 | Aug 19, 2026 |
| ffmpeg · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | ffmpeg 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| ffmpeg · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | ffmpeg 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| ffmpeg · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | ffmpeg 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| ffmpeg-4 · sles 15.7 | 4.4.8-150600.13.55.1 | SUSE-SU-2026:4149-1 | Sep 14, 2026 |
| ffmpeg-7 · opensuse-leap 16.0 | 7.1.5-160000.1.1 | OPENSUSE-SU-2026:21877-1 | Sep 18, 2026 |
| libavcodec-extra · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libavcodec-extra 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libavcodec-extra · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libavcodec-extra 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libavcodec-extra · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libavcodec-extra 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libavcodec-extra58 · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libavcodec-extra58 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libavcodec-extra60 · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libavcodec-extra60 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libavcodec-extra62 · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libavcodec-extra62 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libavcodec58 · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libavcodec58 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libavcodec60 · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libavcodec60 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libavcodec62 · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libavcodec62 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libavdevice58 · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libavdevice58 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libavdevice60 · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libavdevice60 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libavdevice62 · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libavdevice62 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libavfilter-extra · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libavfilter-extra 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libavfilter-extra · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libavfilter-extra 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libavfilter-extra · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libavfilter-extra 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libavfilter-extra11 · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libavfilter-extra11 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libavfilter-extra7 · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libavfilter-extra7 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libavfilter-extra9 · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libavfilter-extra9 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libavfilter11 · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libavfilter11 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libavfilter7 · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libavfilter7 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libavfilter9 · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libavfilter9 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libavformat-extra · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libavformat-extra 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libavformat-extra · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libavformat-extra 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libavformat-extra · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libavformat-extra 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libavformat-extra58 · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libavformat-extra58 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libavformat-extra60 · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libavformat-extra60 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libavformat-extra62 · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libavformat-extra62 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libavformat58 · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libavformat58 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libavformat60 · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libavformat60 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libavformat62 · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libavformat62 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libavutil56 · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libavutil56 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libavutil58 · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libavutil58 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libavutil60 · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libavutil60 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libpostproc55 · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libpostproc55 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libpostproc57 · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libpostproc57 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libswresample3 · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libswresample3 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libswresample4 · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libswresample4 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libswresample6 · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libswresample6 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
| libswscale5 · Ubuntu 22.04.1 LTS (jammy) | 7:4.4.2-0ubuntu0.22.04.1+esm15 | libswscale5 7:4.4.2-0ubuntu0.22.04.1+esm15 | Sep 5, 2026 |
| libswscale7 · Ubuntu 24.04.5 LTS (noble) | 7:6.1.1-3ubuntu5+esm13 | libswscale7 7:6.1.1-3ubuntu5+esm13 | Sep 5, 2026 |
| libswscale9 · Ubuntu 26.04.1 LTS (resolute) | 7:8.0.1-3ubuntu2+esm4 | libswscale9 7:8.0.1-3ubuntu2+esm4 | Aug 19, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.