CVE-2026-58049

HIGH 8.8 PoC AVAILABLE

Published 2026-06-28 · Last modified 2026-06-30

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.

EXPLOIT AVAILABLE

Public exploit or PoC code exists. Modeled probability is still low, but the barrier to attack is reduced — watch closely.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 12th percentile

○ In CISA KEV ● Public exploit / PoC

Impact if exploited

8.8CVSS 4.0 · HIGH

ConfidentialityLow
IntegrityLow
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable
✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

PoC https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc

Listed for defensive triage and patch prioritization.

Affected

Vendors Ffmpeg Red Hat

Products Ffmpeg Red Hat Enterprise Linux Ai (Rhel Ai) 3 Red Hat Openshift Ai (Rhoai)

Weakness (CWE)

CWE-787: Out-of-bounds write

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

References

Sources: NVD · CVE.org · EPSS