UBUNTU-CVE-2026-58049 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2026-58049

HIGH8.8

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather

Published Jun 28, 2026

Modified 3 weeks ago

Details

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.

Affected Packages

ffmpeg

Ubuntu 25.10

Affected versions:

7:7.1.1-1ubuntu17:7.1.1-1ubuntu27:7.1.1-1ubuntu37:7.1.1-1ubuntu47:7.1.1-1ubuntu4.17:7.1.1-1ubuntu4.2

ffmpeg

Ubuntu Pro 16.04 LTS

Affected versions:

7:2.7.2-1build17:2.8.1-1ubuntu17:2.8.10-0ubuntu0.16.04.17:2.8.11-0ubuntu0.16.04.17:2.8.14-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.17:2.8.15-0ubuntu0.16.04.1+esm17:2.8.17-0ubuntu0.17:2.8.17-0ubuntu0.1+esm17:2.8.17-0ubuntu0.1+esm10+22 more

References

REPORT

https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c

REPORT

https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc

REPORT

https://ubuntu.com/security/CVE-2026-58049

REPORT

https://www.cve.org/CVERecord?id=CVE-2026-58049

REPORT

https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta

CVSS Analysis