ANT-2026-RXSADDFE · ffmpeg/ffmpeg

heap-buffer-overflow high

Severity Claude high · Security research firm high · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics.

ANT-2026-RXSADDFE: Heap-buffer-overflow in g2meet.c:486

While decoding a crafted G2M (GoToMeeting) frame, epic_decode_tile() invokes epic_decode_run_length(), which calls is_pixel_on_stack() at g2meet.c:486. That function performs a 4-byte read immediately past the end of a 10912-byte heap buffer that was allocated as the codec's private context via avcodec_alloc_context3(). An attacker who can deliver a G2M-encoded video to any FFmpeg-based consumer controls the tile data that drives this path. The result is an out-of-bounds heap read that can crash the decoder and may disclose adjacent heap contents.

Target

Project: ffmpeg
Location: g2meet.c:486

Technical Details

ASAN: "READ of size 4 at 0x78b6b98e2ba0 ... 0 bytes after 10912-byte region". The ePIC run-length path indexes the decoder's pixel stack without ensuring the index stays within the private-data allocation, so is_pixel_on_stack() dereferences one 32-bit element past the end of the buffer. The missing bound check on the stack position in epic_decode_run_length() is the root cause.

Crash trace (truncated — full trace in attached crash.log):

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 4275065820
INFO: Loaded 1 modules   (68486 inline 8-bit counters): 68486 [0x62b3829e7080, 0x62b3829f7c06), 
INFO: Loaded 1 PC tables (68486 PCs): 68486 [0x62b3829f7c08,0x62b382b03468), 
/out/ffmpeg_AV_CODEC_ID_G2M_fuzzer: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
EXIT_CODE:1


=== ASAN Report ===
=================================================================
==27==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x78b6b98e2ba0 at pc 0x62b3822b4b1c bp 0x7fff9cf4c630 sp 0x7fff9cf4c628
READ of size 4 at 0x78b6b98e2ba0 thread T0
    #0 0x62b3822b4b1b in is_pixel_on_stack /src/ffmpeg/libavcodec/g2meet.c:486:13
    #1 0x62b3822b4b1b in epic_decode_run_length /src/ffmpeg/libavcodec/g2meet.c:647:22
    #2 0x62b3822b4b1b in epic_decode_tile /src/ffmpeg/libavcodec/g2meet.c:830:33
    #3 0x62b3822af9a2 in epic_jb_decode_tile /src/ffmpeg/libavcodec/g2meet.c:928:15
    #4 0x62b3822ad571 in g2m_decode_frame /src/ffmpeg/libavcodec/g2meet.c:1511:23
    #5 0x62b38228964a in decode_simple_internal /src/ffmpeg/libavcodec/decode.c:444:16
    #6 0x62b38228964a in decode_simple_receive_frame /src/ffmpeg/libavcodec/decode.c:604:15
    #7 0x62b38228964a in ff_decode_receive_frame_internal /src/ffmpeg/libavcodec/decode.c:640:15
    [... 20 more frames — full trace in crash.log]

Reproduction

Craft a G2M bitstream containing an ePIC/JB tile whose run-length data drives the pixel-stack index out of range
Deliver the file/stream to the victim (e.g., upload, media message, transcoding pipeline)
Victim calls avcodec_send_packet(); g2m_decode_frame → epic_decode_tile → epic_decode_run_length → is_pixel_on_stack reads past the heap buffer

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-RXSADDFE.

Reference: ANT-2026-RXSADDFE
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Ada Logics.

Verdict: true positive
Severity: high

TIMELINE

Dates from discovery through public reveal.

2026-03-24 Reported to tracker
2026-05-10 Sent to maintainer
2026-05-19 Patch released
2026-05-19 Maintainer acknowledged
2026-07-20 Publicly revealed

PROVENANCE

SHA-3-512 hash:

a56ab0d1ce61e11f2549a86f99f831a877d2f40b16e04ddca6c2ffc3c01e10c8e88b97985e4f79df488cde2daf884efbc40dddd8feeda1e21e96f9e569bb30f6

Committed 2026-05-13 10:55 PT

Revealed 2026-07-20 21:57 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-RXSADDFE",
  "bug_class": "Heap-buffer-overflow",
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-24T18:33:36+00:00",
  "description": "While decoding a crafted G2M (GoToMeeting) frame, epic_decode_tile() invokes epic_decode_run_length(), which calls is_pixel_on_stack() at g2meet.c:486. That function performs a 4-byte read immediately past the end of a 10912-byte heap buffer that was allocated as the codec's private context via avcodec_alloc_context3(). An attacker who can deliver a G2M-encoded video to any FFmpeg-based consumer controls the tile data that drives this path. The result is an out-of-bounds heap read that can crash the decoder and may disclose adjacent heap contents.",
  "discovered_at": null,
  "location": "g2meet.c:486",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "ffmpeg",
  "reproduction": [
    "1. Craft a G2M bitstream containing an ePIC/JB tile whose run-length data drives the pixel-stack index out of range",
    "2. Deliver the file/stream to the victim (e.g., upload, media message, transcoding pipeline)",
    "3. Victim calls avcodec_send_packet(); g2m_decode_frame → epic_decode_tile → epic_decode_run_length → is_pixel_on_stack reads past the heap buffer"
  ],
  "technical_details": "ASAN: \"READ of size 4 at 0x78b6b98e2ba0 ... 0 bytes after 10912-byte region\". The ePIC run-length path indexes the decoder's pixel stack without ensuring the index stays within the private-data allocation, so is_pixel_on_stack() dereferences one 32-bit element past the end of the buffer. The missing bound check on the stack position in epic_decode_run_length() is the root cause.",
  "title": "Heap-buffer-overflow in g2meet.c:486",
  "vendor_severity": "high"
}