CyberRota Analysis
AI-GeneratedThe vulnerability affects FFmpeg prior to commit 983dae9, specifically in the AV1 RTP packetizer, where an out-of-bounds read can occur due to improper handling of the OBU size in the keyframe detection loop. This flaw allows an attacker to craft an AV1 input packet that, when processed, can lead to potential information disclosure or application crashes. Organizations using FFmpeg for media processing, particularly those handling RTP streams, should prioritize patching this vulnerability to mitigate risks associated with malicious input.
Original NVD Description
FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer (libavformat/rtpenc_av1.c). The keyframe detection loop that searches for a sequence header OBU advanced its pointer and remaining-size counter by the encoded header length plus the OBU payload size without first bounding the OBU size against the remaining data. A crafted OBU size causes the remaining-size counter to wrap to a positive value, causing the next loop iteration to dereference a pointer beyond the end of the packet buffer. A crafted AV1 input packet muxed to RTP triggers the out-of-bounds read.