Skip to main content

FFmpeg CVE-2026-12706

| EUVDEUVD-2026-38004 MEDIUM
Use After Free (CWE-416)
2026-06-19 redhat GHSA-qh4m-69pj-9vc2
Use After Free Memory Corruption Denial Of Service Red Hat Enterprise Linux Ai Rhel Ai 3 Red Hat Openshift Ai Rhoai Red Hat Suse
6.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Network-delivered file with mandatory user interaction; impact is crash-only (no code execution), so C:N/I:N/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jun 19, 2026 - 11:51 vuln.today
CVE Published
Jun 19, 2026 - 10:55 cve.org
MEDIUM 6.5

DescriptionCVE.org

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).

AnalysisAI

Use-after-free in FFmpeg's RASC video decoder exposes Red Hat Enterprise Linux AI 3 and Red Hat OpenShift AI deployments to denial-of-service attacks via crafted media files. The decode_move() function retains a raw pointer into a heap-allocated decompressed buffer that is subsequently reallocated during move-table processing, leaving the pointer dangling; reading through it crashes the process. No public exploit or KEV listing has been identified at time of analysis, but the network-accessible attack vector (file delivery over the internet) and lack of authentication prerequisites make this a realistic threat to any environment that processes untrusted AVI content using the affected FFmpeg builds.

Technical ContextAI

CWE-416 (Use After Free) describes the root cause: FFmpeg's decode_move() function captures a raw pointer into a heap buffer holding decompressed RASC frame data. When move-table processing subsequently triggers a reallocation of that same buffer (e.g., via realloc() to expand capacity), the allocator may move the buffer to a new address and free the old region. The cached pointer is never updated, so any read performed after the reallocation accesses freed heap memory. This is a classic temporal memory safety violation in C/C++ media codec code. The RASC codec processes video streams embedded in AVI container files. Affected CPE strings confirm the flaw surfaces in Red Hat Enterprise Linux AI (RHEL AI) 3 and Red Hat OpenShift AI (RHOAI) products, both of which incorporate FFmpeg. The upstream issue is tracked on the FFmpeg mailing list and a patch is available on the FFmpeg patchwork system.

RemediationAI

Apply the vendor-supplied fix from Red Hat as documented at https://access.redhat.com/security/cve/CVE-2026-12706; the exact patched package version is not independently confirmed from the available data and should be verified directly in that advisory. An upstream FFmpeg patch is available on the FFmpeg patchwork system at https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/ - note this is a patch submission, not a tagged release, so the specific FFmpeg release incorporating the fix should be confirmed before upgrading. As a compensating control where patching is not immediately possible, restrict or disable processing of untrusted AVI files in RHEL AI and RHOAI environments, particularly in any automated media ingestion or preview pipelines; this eliminates the attack surface but may impact legitimate video processing workflows. Blocking RASC-encoded AVI files at the file-type inspection layer (e.g., via a media proxy or content filter) is a lower-impact workaround that avoids disrupting other codec processing.

More in Red Hat Enterprise Linux Ai Rhel Ai 3

View all
CVE-2026-6859 HIGH
8.8 Apr 22

Remote code execution in InstructLab affects Red Hat Enterprise Linux AI 3 when users download or train models from Hugg
CVE-2026-6855 HIGH
7.1 Apr 22

Path traversal in InstructLab's chat session handler enables local authenticated attackers to write files to arbitrary f
CVE-2026-6385 MEDIUM
6.5 Apr 15

A remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/
CVE-2026-12491 MEDIUM
4.8 Jun 17

Image input manipulation in vLLM's multimodal preprocessing pipeline allows remote, unauthenticated network attackers to

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected

Share

CVE-2026-12706 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy