CVE-2026-30754

CVE-2026-30754 is an out-of-bounds write (CWE-787) in the nal_send function of FFmpeg's RTP encoder for H.264/HEVC (libavformat/rtpenc_h264_hevc.c), where a negative size parameter (size=-3) is passed to memcpy. It is triggered when FFmpeg before 8.1 processes a crafted H.264 or HEVC input file and transmits it over RTP, corrupting memory during packetization; the flaw was found via AddressSanitizer rather than through observed attacks. An attacker who gets a malicious file processed by an FFmpeg-based streaming pipeline can corrupt memory, potentially crashing the process or, given the high confidentiality, integrity and availability ratings in the CVSS score, gaining code execution in the context of the FFmpeg process. Any FFmpeg build prior to 8.1 that invokes the RTP encoder for H.264/HEVC is affected, which in practice means media servers, relays and streaming tools that output RTP/RTSP, while deployments that only transcode or play files locally are unlikely to hit the vulnerable path. No public proof-of-concept, KEV listing, or known exploitation exists, and the 0.2% EPSS score indicates low near-term exploitation risk.

What to do: Upgrade FFmpeg to 8.1 or later, which resolves the flaw in libavformat/rtpenc_h264_hevc.c. Where upgrading is not immediately possible, avoid streaming untrusted or user-supplied H.264/HEVC input through FFmpeg's RTP output (e.g., -f rtp) or restrict such jobs to trusted files. Operators should inventory FFmpeg-based streaming pipelines (media servers, relays, transcoding workers with RTP output) to confirm whether the vulnerable code path is actually used.