Junglewise Threat Intelligence

CVE-2026-12706: FFmpeg use-after-free in RASC video decoder decode_move

CVE-2026-12706 · Severity: medium · CVSS 6.5 · Published 2026-06-19

Technologies: Red Hat Enterprise Linux AI (RHEL AI) 3, Ffmpeg. Vendors: Red Hat, Ffmpeg.

Executive brief

A security vulnerability was found in FFmpeg, a widely used software library for handling video and audio files. By tricking a user into opening a specially crafted AVI video file, an attacker can cause the application to crash. This issue primarily impacts the reliability and availability of services or applications that use FFmpeg to process video content.

Technical details

A heap use-after-free vulnerability exists in the RASC video decoder within FFmpeg's libavcodec/rasc.c. The issue occurs in the decode_move() function when processing a MOVE chunk with zlib compression enabled. A GetByteContext pointer is initialized to a decompressed buffer (s->delta), but a subsequent call to av_fast_padded_malloc() may reallocate that buffer, leaving the pointer dangling. Subsequent read operations using the stale pointer result in a 16-byte use-after-free read. This can be triggered by a remote attacker providing a crafted AVI file with the 'RASC' FourCC, leading to a deterministic crash in hardened environments. A fix has been merged into FFmpeg master that introduces a dedicated scratch buffer to prevent pointer invalidation.

Affected products

  • FFmpeg FFmpeg All versions through commit 78da965
  • Red Hat Enterprise Linux AI (RHEL AI) 3 3

Timeline

  • 2026-05-01: patched: Fix submitted via PR #22992 by Michael Niedermayer
  • 2026-06-19: disclosed: CVE published and Red Hat advisory released

References

Related threats