Log in Start free

Vulnerability · Published Jun 28, 2026 · Assigned by VulnCheck

CVE-2026-58049FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()

High 8.6

In plain English

A high-severity out-of-bounds write in FFmpeg from FFmpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.5%top 57.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ffmpegno fix listedDEBIAN-CVE-2026-58049
Debian:13ffmpegno fix listedDEBIAN-CVE-2026-58049
Debian:14ffmpeg7:9.0.2-1DEBIAN-CVE-2026-58049
Ubuntu:25.10ffmpegno fix listedUBUNTU-CVE-2026-58049
Ubuntu:26.10ffmpegno fix listedUBUNTU-CVE-2026-58049

Affected products (as reported)

VendorProductVersions
FFmpeg FFmpeg 0 – through bcd2c69e087a09b07cf45c6bd2428ee1ccb2925c

Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References