FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.
7:7.1.1-1ubuntu17:7.1.1-1ubuntu27:7.1.1-1ubuntu37:7.1.1-1ubuntu47:7.1.1-1ubuntu4.17:7.1.1-1ubuntu4.26:0.8.7-1ubuntu26:9.10-1ubuntu16:9.10-1ubuntu26:9.10-1ubuntu56:9.10-1ubuntu66:9.10-1ubuntu76:9.11-2ubuntu16:9.11-2ubuntu26:9.13-0ubuntu0.14.04.16:9.14-0ubuntu0.14.04.1+4 more7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm10+22 more7:3.3.4-27:3.3.4-2build37:3.4-2ubuntu27:3.4-47:3.4-4build17:3.4.1-17:3.4.1-1build17:3.4.11-0ubuntu0.17:3.4.11-0ubuntu0.1+esm17:3.4.11-0ubuntu0.1+esm10+16 more7:4.1.4-1build27:4.2.1-27:4.2.1-2ubuntu17:4.2.2-1build17:4.2.2-1ubuntu17:4.2.4-1ubuntu0.17:4.2.4-1ubuntu0.1+esm17:4.2.7-0ubuntu0.17:4.2.7-0ubuntu0.1+esm17:4.2.7-0ubuntu0.1+esm10+11 more7:4.4-6ubuntu57:4.4.1-2ubuntu17:4.4.1-3ubuntu17:4.4.1-3ubuntu27:4.4.1-3ubuntu37:4.4.1-3ubuntu57:4.4.2-0ubuntu0.22.04.17:4.4.2-0ubuntu0.22.04.1+esm17:4.4.2-0ubuntu0.22.04.1+esm107:4.4.2-0ubuntu0.22.04.1+esm11+9 more7:6.0-6ubuntu17:6.0-9ubuntu17:6.1-2ubuntu17:6.1-3ubuntu17:6.1-4ubuntu17:6.1-5ubuntu17:6.1.1-1ubuntu17:6.1.1-3ubuntu17:6.1.1-3ubuntu57:6.1.1-3ubuntu5+esm1+8 more7:7.1.1-1ubuntu47:7.1.2-1ubuntu37:7.1.2-1ubuntu47:7.1.3-1ubuntu17:8.0.1-2ubuntu17:8.0.1-3ubuntu17:8.0.1-3ubuntu27:8.0.1-3ubuntu2+esm1Exploitability
AV:NAC:LAT:NPR:NUI:NVulnerable System
VC:LVI:LVA:HSubsequent System
SC:NSI:NSA:NCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N