diff --git a/go.mod b/go.mod
index 8addb120..fcfe86f7 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/bluenviron/gortsplib/v4
 go 1.19
 
 require (
-	github.com/bluenviron/mediacommon v1.0.1
+	github.com/bluenviron/mediacommon v1.0.2-0.20230901160448-b7b4863d6096
 	github.com/google/uuid v1.3.1
 	github.com/pion/rtcp v1.2.10
 	github.com/pion/rtp v1.8.1
diff --git a/go.sum b/go.sum
index abf6c7db..72154555 100644
--- a/go.sum
+++ b/go.sum
@@ -2,8 +2,8 @@ github.com/asticode/go-astikit v0.30.0 h1:DkBkRQRIxYcknlaU7W7ksNfn4gMFsB0tqMJflx
 github.com/asticode/go-astikit v0.30.0/go.mod h1:h4ly7idim1tNhaVkdVBeXQZEE3L0xblP7fCWbgwipF0=
 github.com/asticode/go-astits v1.13.0 h1:XOgkaadfZODnyZRR5Y0/DWkA9vrkLLPLeeOvDwfKZ1c=
 github.com/asticode/go-astits v1.13.0/go.mod h1:QSHmknZ51pf6KJdHKZHJTLlMegIrhega3LPWz3ND/iI=
-github.com/bluenviron/mediacommon v1.0.1 h1:+Wiy0OmNxnIqJQ9MUcvldbTtJRmdjoxeyeSdDkSCExI=
-github.com/bluenviron/mediacommon v1.0.1/go.mod h1:/vlOVSebDwzdRtQONOKLua0fOSJg1tUDHpP+h9a0uqM=
+github.com/bluenviron/mediacommon v1.0.2-0.20230901160448-b7b4863d6096 h1:quTSEtdDapDQilHCiVeV4Un7NcWby4hVIiJAjqf+XXk=
+github.com/bluenviron/mediacommon v1.0.2-0.20230901160448-b7b4863d6096/go.mod h1:/vlOVSebDwzdRtQONOKLua0fOSJg1tUDHpP+h9a0uqM=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
diff --git a/pkg/format/mpeg4_video_es.go b/pkg/format/mpeg4_video_es.go
index 2a09cd57..14bc67ba 100644
--- a/pkg/format/mpeg4_video_es.go
+++ b/pkg/format/mpeg4_video_es.go
@@ -5,7 +5,9 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
+	"sync"
 
+	"github.com/bluenviron/mediacommon/pkg/codecs/mpeg4video"
 	"github.com/pion/rtp"
 
 	"github.com/bluenviron/gortsplib/v4/pkg/format/rtpmpeg4video"
@@ -20,6 +22,8 @@ type MPEG4VideoES struct {
 	PayloadTyp     uint8
 	ProfileLevelID int
 	Config         []byte
+
+	mutex sync.RWMutex
 }
 
 func (f *MPEG4VideoES) unmarshal(ctx *unmarshalContext) error {
@@ -42,6 +46,11 @@ func (f *MPEG4VideoES) unmarshal(ctx *unmarshalContext) error {
 			if err != nil {
 				return fmt.Errorf("invalid config: %v", val)
 			}
+
+			err = mpeg4video.IsValidConfig(f.Config)
+			if err != nil {
+				return fmt.Errorf("invalid config: %v", err)
+			}
 		}
 	}
 
@@ -72,7 +81,10 @@ func (f *MPEG4VideoES) RTPMap() string {
 func (f *MPEG4VideoES) FMTP() map[string]string {
 	fmtp := map[string]string{
 		"profile-level-id": strconv.FormatInt(int64(f.ProfileLevelID), 10),
-		"config":           strings.ToUpper(hex.EncodeToString(f.Config)),
+	}
+
+	if f.Config != nil {
+		fmtp["config"] = strings.ToUpper(hex.EncodeToString(f.Config))
 	}
 
 	return fmtp
@@ -108,3 +120,17 @@ func (f *MPEG4VideoES) CreateEncoder() (*rtpmpeg4video.Encoder, error) {
 
 	return e, nil
 }
+
+// SafeSetParams sets the codec parameters.
+func (f *MPEG4VideoES) SafeSetParams(config []byte) {
+	f.mutex.Lock()
+	defer f.mutex.Unlock()
+	f.Config = config
+}
+
+// SafeParams returns the codec parameters.
+func (f *MPEG4VideoES) SafeParams() []byte {
+	f.mutex.RLock()
+	defer f.mutex.RUnlock()
+	return f.Config
+}
diff --git a/pkg/format/rtpmpeg4video/decoder.go b/pkg/format/rtpmpeg4video/decoder.go
index d8f4d130..d07b806f 100644
--- a/pkg/format/rtpmpeg4video/decoder.go
+++ b/pkg/format/rtpmpeg4video/decoder.go
@@ -5,15 +5,13 @@ import (
 	"fmt"
 
 	"github.com/pion/rtp"
+
+	"github.com/bluenviron/mediacommon/pkg/codecs/mpeg4video"
 )
 
 // ErrMorePacketsNeeded is returned when more packets are needed.
 var ErrMorePacketsNeeded = errors.New("need more packets")
 
-const (
-	maxFrameSize = 1 * 1024 * 1024
-)
-
 func joinFragments(fragments [][]byte, size int) []byte {
 	ret := make([]byte, size)
 	n := 0
@@ -49,9 +47,9 @@ func (d *Decoder) Decode(pkt *rtp.Packet) ([]byte, error) {
 		}
 	} else {
 		d.fragmentsSize += len(pkt.Payload)
-		if d.fragmentsSize > maxFrameSize {
+		if d.fragmentsSize > mpeg4video.MaxFrameSize {
 			d.fragments = d.fragments[:0] // discard pending fragments
-			return nil, fmt.Errorf("frame size (%d) is too big, maximum is %d", d.fragmentsSize, maxFrameSize)
+			return nil, fmt.Errorf("frame size (%d) is too big, maximum is %d", d.fragmentsSize, mpeg4video.MaxFrameSize)
 		}
 
 		d.fragments = append(d.fragments, pkt.Payload)
diff --git a/pkg/format/testdata/fuzz/FuzzUnmarshalH264/def20bf5816007f3 b/pkg/format/testdata/fuzz/FuzzUnmarshalH264/def20bf5816007f3
new file mode 100644
index 00000000..09971b9a
--- /dev/null
+++ b/pkg/format/testdata/fuzz/FuzzUnmarshalH264/def20bf5816007f3
@@ -0,0 +1,3 @@
+go test fuzz v1
+string(",")
+string("0")
diff --git a/pkg/format/testdata/fuzz/FuzzUnmarshalH265/85fd1a8f82a0e5c4 b/pkg/format/testdata/fuzz/FuzzUnmarshalH265/85fd1a8f82a0e5c4
new file mode 100644
index 00000000..d6aa303f
--- /dev/null
+++ b/pkg/format/testdata/fuzz/FuzzUnmarshalH265/85fd1a8f82a0e5c4
@@ -0,0 +1,5 @@
+go test fuzz v1
+string("0")
+string("\x00")
+string("")
+string("0\xa5")
diff --git a/pkg/format/testdata/fuzz/FuzzUnmarshalMPEG4VideoES/85649d45641911d0 b/pkg/format/testdata/fuzz/FuzzUnmarshalMPEG4VideoES/85649d45641911d0
new file mode 100644
index 00000000..befd7df0
--- /dev/null
+++ b/pkg/format/testdata/fuzz/FuzzUnmarshalMPEG4VideoES/85649d45641911d0
@@ -0,0 +1,3 @@
+go test fuzz v1
+string("0")
+string("")