CVE-2026-12706
Description
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).
Statement
This vulnerability is rated as Moderate severity because the proven impact is limited to denial of service through a heap read from freed memory. Exploitation requires user interaction: a victim must open or play a crafted AVI file containing a malicious RASC video stream. RASC is a screen-capture codec with limited real-world usage, which reduces the likelihood of encountering malicious RASC content in typical workflows.
RHEL AI 3.4 ships FFmpeg 6.1.x as an RPM and embedded in bootc container images, and is affected. RHOAI 2.25, 3.3, and 3.4 embed FFmpeg in the vllm-gaudi container image and are affected. Fedora and EPEL ship FFmpeg as ffmpeg-free and are also affected.
The RHOAI openvino-model-server images ship only the ffmpeg-python wrapper, which does not expose the RASC decoder code path and is not affected. The nv-codec-headers packages (rhel-br streams) contain only build headers with no FFmpeg library code and are not affected. The services-subscription-central deployment bundles FFmpeg as a transitive dependency but does not process user-supplied video content in a way that would reach the RASC decoder.
Mitigation
If the RASC decoder is not needed, it can be disabled at build time with --disable-decoder=rasc. There is no runtime workaround that disables the decoder without rebuilding FFmpeg.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory
The use of previously freed memory may corrupt valid data, if the memory area in question has been allocated and used properly elsewhere.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If chunk consolidation occurs after the use of previously freed data, the process may crash when invalid data is used as chunk information.
Confidentiality
Technical Impact: Read Memory
Read operations on freed memory can sometimes leak sensitive information instead of causing a crash
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If malicious data is entered before chunk consolidation can take place, it may be possible to take advantage of a write-what-where primitive to execute arbitrary code. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved.
Acknowledgements
Upstream acknowledges Seung Min Shin as the original reporter.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
