21 Zero-Days in FFmpeg | depthfirst

What it is

depthfirst reports 21 fixed memory-safety bugs in FFmpeg, found by its autonomous security agent at a stated cost of about $1k. The post says that is 10% of what Anthropic spent scanning FFmpeg with Mythos. Nine bugs have CVE-2026-39210 through CVE-2026-39218. The other twelve are listed under depthfirst's internal IDs, DFVULN-116 to DFVULN-127. The post says these are fixed but gives no fixed versions or commit links.

The nine CVEs

Network-reachable bugs without a CVE

Several DFVULN items sit in network protocol code, so they matter most for services that open untrusted URLs.

• DFVULN-127: RTP AV1 depacketizer, heap overflow (details below).
• DFVULN-125: RTP JPEG depacketizer. A crafted packet with qtable_len >= 1024 overflows a 1024-byte stack buffer by two bytes.
• DFVULN-123: RTP LATM depacketizer. A signed 32-bit addition overflows and bypasses a bounds check, so memcpy reads about 1 GB past a heap buffer.
• DFVULN-122: RTP MPEG-4 depacketizer. An AU-headers-length of 0 leads to a one-byte allocation read as a four-byte field. It dates from 2005.
• DFVULN-118: RTSP server path. An ANNOUNCE with Content-Length: -1 writes to sdp[-1]. It is a 2021 regression.
• DFVULN-117: RTMP client. A check of in_size < 3 should be in_size < 8, so memcpy reads eight bytes from a buffer as small as three.
• DFVULN-116: RTSP SDP parsing. strlen(control_url) - 1 on an empty string wraps to SIZE_MAX.

File-based items: DFVULN-126 (swscale interlaced YUV420P to NV12, 576-byte Y-plane overflow), DFVULN-124 (AVIF tile grid with zero entries), DFVULN-121 (CAF seek indexes index_entries[-1]), DFVULN-120 (AVI LIST chunk of size 0 underflows to about 4 GB and triggers a roughly 2 GB allocation, DoS), and DFVULN-119 (opt_map() stores stream index -1).

How the AV1 RTP exploit works

The bug is in av1_handle_packet() in libavformat/rtpdec_av1.c. When it skips a Temporal Delimiter OBU, it advances the output cursor pktpos by the attacker-declared obu_size. It allocates nothing for that advance, and it does not move the input pointer buf_ptr.

Because buf_ptr stays put, the next loop pass re-parses the delimiter's own bytes as a new OBU, so the attacker also controls the written data. In the example, obu_size is 148 and a fabricated 17-byte OBU makes av_grow_packet allocate 81 bytes (17 plus 64 padding). Writes begin at offset 148, which is 67 bytes past the end.

FFmpeg's av_buffer_alloc puts the data buffer, then an AVBuffer struct, in adjacent heap chunks. The 81-byte buffer occupies a 128-byte chunk, so AVBuffer.free sits at offset 152. The write starting at 148 leaves refcount (offsets 144 to 147) at 1 and overwrites free.

A third fabricated OBU triggers one more av_grow_packet. The buffer is not flagged reallocatable, so buffer_replace drops the refcount to 0 and calls b->free. The result is RIP = 0xdeadbeef from a single 183-byte packet on a release build. The post links a PoC.

Preconditions / Affected

For the AV1 bug, a victim runs ffmpeg -i rtsp://attacker/stream with no special flags. It triggers during the normal RTSP PLAY phase, with no authentication or further user interaction. The post names three exposed deployments: ingest pipelines fetching user-supplied stream URLs, RTSP surveillance clients, and transcoders handling remote AV1-over-RTP.

Exploitability is demonstrated only for DFVULN-127. The others are described as bugs, and the post makes no exploitation claims for them.

What to do

The post states no patch versions, so check your FFmpeg build against upstream fixes for the CVE and DFVULN items above. Services that open attacker-influenced RTSP, RTMP or other network URLs, or untrusted TS, DASH, AVI, CAF and AVIF files, are the ones exposed.

Caveats

This is a vendor post comparing its own cost and coverage to Google Big Sleep and Anthropic Mythos, without detailing their methods. Three flaws predate 2010: SDT (2003) and the MPEG-4 and LATM RTP depacketizers (2005 and 2010).