CVE-2026-58049

HIGH

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.

CVSS v3.1 Score

8.6
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
HIGH
Published: 6/28/2026Modified: 6/30/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2026-58049 — FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit r...

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled ou

CVE-2026-58049
NIST NVD

References (6)

https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.chttps://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-pochttps://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dltahttps://access.redhat.com/security/cve/CVE-2026-58049https://bugzilla.redhat.com/show_bug.cgi?id=2493952https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json