This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-75141 →

DEBIAN-CVE-2026-75141

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of...

Original description

The description as published by the source.

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap buffer overflow. A crafted HEVC input file triggers the overflow during muxing.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ffmpeg

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 ffmpeg

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 ffmpeg

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:9.0.2-1"}]}]

References

advisory security-tracker.debian.org