Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-58049: FFmpeg RASC Video Decoder Allows Memory Corruption
CVE-2026-58049
CVE-2026-58049
Summary
The FFmpeg RASC video decoder has a bug that can cause it to access memory outside its allowed space. This can happen when decoding a specially crafted video file. To stay safe, update to the latest version of FFmpeg.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ffmpeg | ffmpeg | <= bcd2c69e087a09b07cf45c6bd2428ee1ccb2925c |
Original title
FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()
Original description
FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.
nvd CVSS3.1
8.6
nvd CVSS4.0
8.8
Vulnerability type
CWE-787
Out-of-bounds Write
- https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c
- https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc
- https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-...
- https://access.redhat.com/security/cve/CVE-2026-58049
- https://bugzilla.redhat.com/show_bug.cgi?id=2493952
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json
Published: 28 Jun 2026 · Updated: 22 Jul 2026 · First seen: 28 Jun 2026