CVE-2026-58049 Details
Description
FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.
A heap out-of-bounds write vulnerability has been identified in FFmpeg's RASC video decoder, specifically in the 'decode_dlta' function of 'libavcodec/rasc.c'. The issue arises because the decoder performs 32-bit read and write operations at the row cursor before checking the row boundary, and it validates the DLTA region in pixel units rather than bytes. This allows a crafted media stream with the RASC FourCC, when decoded by libavcodec, to manipulate the bitstream and cause a controlled out-of-bounds heap write, along with an adjacent out-of-bounds read, leading to memory corruption.
Users can update to the latest version of FFmpeg, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | redhat-SADP |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
15 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 1, 2026 | CVE Modified | redhat-SADP |
| Aug 28, 2026 | CVE Modified | redhat-SADP |
| Aug 28, 2026 | CVE Modified | [email protected] |
| Aug 17, 2026 | CVE Modified | redhat-SADP |
| Aug 12, 2026 | CVE Modified | redhat-SADP |
| Aug 11, 2026 | CVE Modified | redhat-SADP |
| Aug 7, 2026 | CVE Modified | redhat-SADP |
| Jul 31, 2026 | CVE Modified | redhat-SADP |
| Jul 23, 2026 | CVE Modified | redhat-SADP |
| Jul 22, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 6, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 28, 2026 | New CVE Received | [email protected] |