A critical memory corruption vulnerability in FFmpeg, specifically within the RTP encoding process, poses a high risk of remote code execution for applications processing untrusted media streams.

This is a memory corruption flaw located in the nal_send function within libavformat/rtpenc_h264_hevc.c, where a negative size parameter is passed to memcpy during H.264/HEVC RTP transmission. The vulnerability can be triggered by an unauthenticated remote attacker through a crafted input file.

The CVSS score of 8.8 indicates a high severity risk that could lead to full system compromise. Successful exploitation allows an attacker to achieve remote code execution, potentially resulting in unauthorized data access, service disruption, or the installation of malicious software on systems that process untrusted media content.

Immediate Action: Update FFmpeg to version 8.1 or later to incorporate the necessary memory safety patches.

Proactive Monitoring: Monitor server logs and application performance for crashes or abnormal memory spikes when handling H.264 or HEVC stream encoding tasks.

Compensating Controls: If immediate patching is not feasible, restrict the processing of untrusted media files from external sources to isolated, sandboxed environments to limit the impact of a potential compromise.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository references.

Given the potential for remote code execution and the availability of a public proof-of-concept, this vulnerability should be treated with high priority. Organizations utilizing FFmpeg for streaming or media conversion must verify their version and apply the update to version 8.1 immediately to eliminate this memory corruption risk.