Medium [CVE-2026-75145] Out-of-bounds memory access due to integer narrowing conversion

FFmpeg before commit b4c199c contains an incorrect integer narrowing conversion in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The OBU size is cast to long before comparison against the remaining frame size.

On targets where long is 32 bits, including 64-bit Windows, sufficiently large OBU size values are sign-flipped by the narrowing cast, producing a negative value that passes the payload size check.

This allows an oversized OBU to bypass the safety bound on affected platforms, leading to out-of-bounds memory access when the oversized value is subsequently used as a copy length. A flaw was found in FFmpeg.

An incorrect integer narrowing conversion in the AV1 RTP packetizer can lead to an out-of-bounds memory access. This occurs when processing specially crafted AV1 RTP (Real-time Transport Protocol) packets, where a large OBU (Operating Block Unit) size is incorrectly handled due to a casting issue on certain platforms.

An attacker could exploit this to cause a denial of service or potentially execute arbitrary code. The ffmpeg package is not shipped in base Red Hat Enterprise Linux.

It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in the AV1 RTP packetizer (libavformat/rtpenc_av1.c), which is compiled and shipped in all FFmpeg builds across these products.