SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-30754

HIGH · CVSS 8.8 EPSS 0.35% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-08 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

FFmpeg versions prior to 8.1 are vulnerable to a memory corruption issue during the RTP encoding process, specifically in the nal_send function, where a negative size parameter is improperly handled in memcpy. This flaw can lead to potential application crashes or arbitrary code execution when processing specially crafted H.264/HEVC streams. Developers and organizations utilizing FFmpeg for media streaming should prioritize addressing this vulnerability to mitigate associated risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
gist.github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-30754
Severity
HIGH
CVSS
8.8
EPSS
0.35%

Original NVD Description

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.