High [CVE-2026-75147] Information disclosure or denial of service via crafted AV1 RTP packet
This high-severity Red Hat Linux advisory covers CVE-2026-75147 affecting Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI).
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data.
A crafted OBU size causes the remaining-size counter to wrap to a positive value, causing the next loop iteration to dereference a pointer beyond the end of the packet buffer. A crafted AV1 input packet muxed to RTP triggers the out-of-bounds read.
A flaw was found in FFmpeg's AV1 Real-time Transport Protocol (RTP) packetizer. A local attacker could entice a user to process a crafted AV1 input packet.
This crafted packet could cause an out-of-bounds read, potentially leading to information disclosure or a denial of service (DoS) condition. The ffmpeg package is not shipped in base Red Hat Enterprise Linux.
It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in the AV1 RTP packetizer (libavformat/rtpenc_av1.c), which is compiled and shipped in all FFmpeg builds across these products.
Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H). Weakness: CWE-125.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Mitigation checklist
- No mitigation is currently available for this flaw.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.