What is GHSA-crqp-42h3-7fcv?

GHSA-crqp-42h3-7fcv is a security advisory published by GitHub Security Advisories with High severity. A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the...

Which CVE IDs does GHSA-crqp-42h3-7fcv cover?

GHSA-crqp-42h3-7fcv covers the following CVE IDs: CVE-2026-30754. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-crqp-42h3-7fcv?

GHSA-crqp-42h3-7fcv has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-crqp-42h3-7fcvHighCVSS 8.8

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the...

Vendor

GitHub Security Advisories

Published

September 8, 2026

Last Modified

September 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-30754 →

📋 Description

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-30754
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746
https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6
https://github.com/momo-trip/poc_ffmpeg
https://github.com/advisories/GHSA-crqp-42h3-7fcv