FFmpeg EUVD-2026-39969

| CVE-2026-58049 HIGH

Out-of-bounds Write (CWE-787)

2026-06-28 VulnCheck

GHSA-mjxr-6gqf-w78h

Buffer Overflow Memory Corruption Ffmpeg

8.8

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft RASC stream with malicious DLTA run
Delivery

Deliver media to FFmpeg decoder
Exploit

decode_dlta processes PAL8 frame
Execution

Pixel/byte miscalc bypasses NEXT_LINE check
Persist

Heap out-of-bounds write and adjacent read
Impact

Memory corruption / potential code execution

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that libavcodec actually decode a stream using the RASC FourCC and reach the DLTA delta path on a PAL8 (8-bit palettized) frame - the bitstream-controlled DLTA run is what triggers the byte/pixel boundary miscalculation, so a non-RASC or non-PAL8 input will not reach the bug. The attacker must be able to supply the crafted media to the decoder (file upload, served stream, or local file). Limiting factors: the RASC decoder must be enabled/built-in and the application must accept and process RASC FourCC content (uncommon in typical pipelines); for interactive players a user generally must open the file (adding effective user interaction), whereas unattended transcoders match the stated UI:N. No authentication is required to the decoder itself (PR:N), but reaching it depends on the host application's input-acceptance configuration.
Impact	The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L/VI:L/VA:H, base 8.8) models remote, low-complexity exploitation with no privileges or user interaction and high availability impact - consistent with automated server-side media processing that ingests untrusted files without a human opening them. Publicly available POC code raises practical risk above a theoretical bug, but this is NOT in CISA KEV and no EPSS score was provided, so widespread automated exploitation is unconfirmed. The UI:N rating is realistic only for unattended decode pipelines (upload/transcode services); for desktop players a user typically must open the malicious file, effectively adding user interaction and lowering real-world likelihood. The 4.0 impact metrics (VC:L/VI:L/VA:H) frame this primarily as a memory-corruption/crash (DoS) issue with limited direct confidentiality/integrity loss, though heap OOB writes can sometimes be escalated toward code execution depending on allocator state - that escalation is not demonstrated in the provided data. Note the FourCC/RASC codec is rarely enabled in typical media workflows, which constrains exposure despite FFmpeg's ubiquity.
Exploit ScenarioDerived	An attacker uploads or serves a crafted media file containing a RASC-FourCC stream with a malicious DLTA run targeting a PAL8 frame; when a victim media server auto-transcodes it (or a user opens it), decode_dlta writes past the row buffer, corrupting adjacent heap memory. Given AV:N/AC:L and no required privileges, this is straightforward to deliver remotely, and a public POC already exists, lowering the bar to reproduce a crash or memory-corruption condition.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Jun 28, 2026

Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt memory when libavcodec decodes a crafted stream using the RASC FourCC. The decoder performs 32-bit reads/writes at the row cursor before the NEXT_LINE boundary check and validates DLTA regions in pixel rather than byte units, letting a DLTA run on a PAL8 frame write and read several bytes past the row allocation. Publicly available exploit code exists (reported by VulnCheck); no public active exploitation has been identified at time of analysis.

RemediationAI

No vendor-released patched version is identified in the provided data, so an exact fix version cannot be cited - monitor the FFmpeg project (libavcodec/rasc.c) and the VulnCheck advisory at https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta for the patched release and upgrade to it once published. As an immediate compensating control, disable or blacklist the RASC decoder where it is not needed (FFmpeg's -decoders/whitelist controls or build-time configuration with --disable-decoder=rasc), which removes the attack surface entirely with the trade-off of losing RASC playback. For transcoding/upload services, restrict accepted input to an explicit codec allowlist and reject or sandbox RASC/unknown FourCC streams; run decoding in a hardened, isolated process (seccomp, low-privilege container, memory limits) so an OOB write degrades to a contained crash rather than host compromise, at the cost of added pipeline complexity. Building libavcodec with hardening (ASAN in test, fortify/stack protections, and heap-hardening allocators in production) further raises exploitation difficulty.

Affected VersionsENISA

FFmpeg 0 ≤bcd2c69e087a09b07cf45c6bd2428ee1ccb2925c

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

FFmpeg/libavcodec is the de-facto multimedia decoding library embedded in countless players, browsers, servers, and transcoding pipelines. The affected component is the RASC (Windows/Asus screen-capture style) decoder, specifically its DLTA delta-frame handling for PAL8 (8-bit palettized) frames. The root cause is CWE-787 (Out-of-bounds Write): the code advances and dereferences a 32-bit row cursor and emits writes before performing the NEXT_LINE row-boundary check, and it bounds the DLTA copy region in pixel counts rather than byte counts. Because each PAL8 pixel maps to one byte while the cursor operations are 32-bit, the byte/pixel mismatch plus the deferred boundary check let a bitstream-controlled DLTA run spill past the allocated row buffer, producing both an adjacent out-of-bounds read and a heap out-of-bounds write fully driven by attacker-controlled stream data.

Know when Ffmpeg gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

vuln.today AI 8.6 HIGH

Remote crafted media reaches the decoder with no auth or UI in automated pipelines (AV:N/AC:L/PR:N/UI:N); OOB read gives limited C/I, while the heap OOB write primarily yields crash/corruption (A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

SUSE 8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat 7.6 HIGH

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

1

CVSS changed

Jun 28, 2026 - 02:22 NVD

8.6 (HIGH) 8.8 (HIGH)

DescriptionCVE.org

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.

Executive ViewAI

Why It Matters

FFmpeg video processing component contains a memory corruption vulnerability in the RASC decoder with publicly available exploit code, enabling attackers to corrupt system memory when processing malicious video files. Any organization processing video content-including streaming platforms, media providers, and content management systems-faces immediate service disruption and data integrity risks. Leadership should prioritize urgent mitigation of FFmpeg deployments handling untrusted video sources.

Business Impact: High

Compensating Controls

Disable RASC codec support in FFmpeg if operationally feasible; restrict video input sources to trusted, pre-validated suppliers; run FFmpeg processes in isolated environments with least-privilege access and resource limitations; implement pre-processing validation of video file headers and metadata; use alternative video decoder implementations without RASC support where possible. No vendor-released patch identified at time of analysis.

Threat Intelligence Overview

EPSS Score

0.3%

Top 80% exploitable

Prevalence

Ubiquitous

FFmpeg/libavcodec is embedded in vast numbers of apps and media pipelines

Exploit

POC

Public exploit code exists

Social Media

3

Sightings

Data Quality

8 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

64

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

More in Ffmpeg

View all

CVE-2016-1897 MEDIUM This Month POC

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol

CVE-2017-9993 HIGH Act Now

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric

CVE-2016-1898 MEDIUM This Month POC

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco

CVE-2013-4265 CRITICAL Act Now POC

The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re

CVE-2020-12284 CRITICAL Act Now POC

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA

CVE-2026-30754 HIGH This Week POC

Memory corruption in FFmpeg before 8.1 allows an attacker who can supply a crafted H.264/HEVC media file to corrupt heap

CVE-2021-38094 HIGH This Week POC

Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker

CVE-2021-38093 HIGH This Week POC

Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke

CVE-2021-38092 HIGH This Week POC

Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack

CVE-2021-38091 HIGH This Week POC

Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack

CVE-2021-38090 HIGH This Week POC

Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta

CVE-2021-30123 HIGH This Week POC

FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2012-1889 HIGH POC

CVE-2010-3333 HIGH POC

CVE-2014-1761 HIGH POC

CVE-2009-3129 HIGH POC

CVE-2021-1732 HIGH POC

CVE-2013-3346 CRITICAL POC

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

Vendor StatusVendor

Debian

ffmpeg

Release	Status	Fixed Version	Urgency
bullseye	vulnerable	7:4.3.7-0+deb11u1	-
bullseye (security)	vulnerable	7:4.3.9-0+deb11u2	-
bookworm	vulnerable	7:5.1.8-0+deb12u1	-
bookworm (security)	vulnerable	7:5.1.9-0+deb12u1	-
trixie	vulnerable	7:7.1.3-0+deb13u1	-
trixie (security)	vulnerable	7:7.1.5-0+deb13u1	-
forky, sid	vulnerable	7:8.1.2-2	-
(unstable)	fixed	(unfixed)	-

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7	Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7	Not-Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-58049 ADVISORY https://ubuntu.com/security/notices/USN-8750-1 ADVISORY https://vuldb.com/vuln/374502 REF https://access.redhat.com/errata/RHSA-2026:43711 REF https://access.redhat.com/errata/RHSA-2026:51180 REF https://access.redhat.com/errata/RHSA-2026:52832 REF https://access.redhat.com/errata/RHSA-2026:52833 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:61627 REF https://access.redhat.com/errata/RHSA-2026:61628 REF https://access.redhat.com/errata/RHSA-2026:61629 REF https://access.redhat.com/security/cve/CVE-2026-58049 REF https://bugzilla.redhat.com/show_bug.cgi?id=2493952 REF https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json REF https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy