FFmpeg EUVD-2026-54161

The target must decode a crafted RSCC-encoded video file using FFmpeg's built-in RSCC decoder (libavcodec/rscc.c), which is compiled in by default in standard FFmpeg builds - no non-default configuration is required to be vulnerable. The attacker must craft a tile whose compressed payload inflates to fewer bytes than the tile's declared geometry (width × height × bytes-per-pixel), which requires knowledge of the RSCC tile header format but no authentication or system privileges. Passive user interaction is required (CVSS 4.0 UI:P): a user or automated service must open or process the crafted file, meaning services that automatically decode uploaded or fetched media are at elevated risk. Exploitation is strictly limited to information disclosure - no code execution, no integrity modification, and no availability impact are possible via this flaw. The severity of what can be disclosed is highest in persistent long-running decoding services, where ctx->inflated_buf retains data across many frame decode cycles.

The CVSS 4.0 score of 6.8 (Medium) accurately characterizes real-world risk: attack vector is local (AV:L), passive user interaction is required (UI:P), and impact is confidentiality-only (VC:H, VI:N, VA:N). The local attack vector does not mean physical access - any service that ingests user-supplied video effectively becomes a network-reachable attack surface through the media input pathway, which is the primary threat model for transcoding pipelines, media upload endpoints, and persistent decoding daemons. The risk is materially elevated in persistent decoding services where ctx->inflated_buf accumulates residual data across frames and sessions, potentially leaking sensitive in-process memory (e.g., credentials, keys, or prior user content). No KEV listing exists, no POC has been identified, and EPSS data was not provided, all of which suggest this is not yet actively exploited at scale. The low attack complexity (AC:L) and no-prerequisites configuration (AT:N, PR:N) mean that if a POC were published, reliable exploitation would be straightforward. Overall: a genuine medium-priority finding for any organization operating FFmpeg-based media processing services that accept untrusted input.

An attacker uploads a crafted RSCC-encoded video file to a media transcoding service backed by FFmpeg, engineering the tile compressed data so it decompresses to fewer bytes than the declared tile width-by-height geometry. When FFmpeg's RSCC decoder processes the file, the unwritten tail of ctx->inflated_buf - containing residual heap data from earlier in the session - is incorporated into the decoded frame and written to the transcoder's output file or stream. The attacker then retrieves the output and inspects the frame pixel data for recognizable heap artifacts, potentially recovering fragments of prior decoded media or in-process memory contents. No POC has been identified at time of analysis, but the attack requires only file delivery and standard decoding.