USN-8915-1: FFmpeg vulnerabilities

CVE-2026-30754 is an out-of-bounds write (CWE-787) in the nal_send function of FFmpeg's RTP encoder for H.264/HEVC (libavformat/rtpenc_h264_hevc.c), where a negative size parameter (size=-3) is passed to memcpy. It is triggered when FFmpeg before 8.1 processes a crafted H.264 or HEVC input file and transmits it over RTP, corrupting memory during packetization; the flaw was found via AddressSanitizer rather than through observed attacks. An attacker who gets a malicious file processed by an FFmpeg-based streaming pipeline can corrupt memory, potentially crashing the process or, given the high confidentiality, integrity and availability ratings in the CVSS score, gaining code execution in the context of the FFmpeg process. Any FFmpeg build prior to 8.1 that invokes the RTP encoder for H.264/HEVC is affected, which in practice means media servers, relays and streaming tools that output RTP/RTSP, while deployments that only transcode or play files locally are unlikely to hit the vulnerable path. No public proof-of-concept, KEV listing, or known exploitation exists, and the 0.2% EPSS score indicates low near-term exploitation risk.

Do: Upgrade FFmpeg to 8.1 or later, which resolves the flaw in libavformat/rtpenc_h264_hevc.c. Where upgrading is not immediately possible, avoid streaming untrusted or user-supplied H.264/HEVC input through FFmpeg's RTP output (e.g., -f rtp) or restrict such jobs to trusted files. Operators should inventory FFmpeg-based streaming pipelines (media servers, relays, transcoding workers with RTP output) to confirm whether the vulnerable code path is actually used.

FFmpeg build N-122528-gdd2976b9e1 contains a NULL pointer dereference (CWE-476) in the get_min_buffer_size function in libswscale/slice.c. An attacker triggers it by supplying a crafted video file that an FFmpeg-based application processes through the swscale slice-based scaling path, causing the process to crash. The impact is denial of service only (CVSS 3.1: 7.5, C:N/I:N/A:H), with no code execution or data exposure. Anyone running that FFmpeg build, or applications and services bundling its libswscale/FFmpeg libraries, is potentially affected; the available data does not specify which stable release versions carry the flaw. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known, and EPSS puts 30-day exploitation probability at only 0.3%.

Do: Organizations that process untrusted video with FFmpeg (transcoding services, streaming/media servers, media pipelines) should check their bundled FFmpeg build (e.g., via 'ffmpeg -version') and update to a patched FFmpeg build once the upstream fix and affected release range are published in the FFmpeg advisory for CVE-2026-38344. As interim mitigation, restrict ingestion of video files from untrusted sources and configure processing workers to restart automatically on crash, since the impact is limited to a crash/denial of service. With no known PoC or in-the-wild exploitation and low EPSS, urgency is low, but monitor the upstream advisory for the fixed versions.