CVE-2026-12706
Received Received - Intake
Use-After-Free in FFmpeg RASC Video Decoder

Publication date: 2026-06-19

Last updated on: 2026-06-19

Assigner: Red Hat, Inc.

Description
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-19
Last Modified
2026-06-19
Generated
2026-06-19
AI Q&A
2026-06-19
EPSS Evaluated
N/A
NVD
CVE-2026-12706
EUVD
EUVD-2026-38004
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
ffmpeg ffmpeg *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue found in FFmpeg's RASC video decoder, specifically in the decode_move() function. The function initializes a read pointer into a decompressed buffer, but during processing, the buffer is reallocated, which frees the original memory. However, the pointer still references the freed memory, creating a dangling pointer. When a specially crafted AVI file containing a malicious RASC video stream is opened or played, the decoder reads from this freed heap memory, which can cause a crash or other unintended behavior.

Impact Analysis

Exploiting this vulnerability can lead to a denial of service, causing the application using FFmpeg to crash when processing a maliciously crafted AVI file with a RASC video stream. Depending on how the heap memory is reused, it may also allow for arbitrary code execution, which could compromise the security of the system running the vulnerable FFmpeg version.

Detection Guidance

This vulnerability is triggered when processing specially crafted AVI files containing a malicious RASC video stream. Detection involves identifying attempts to open or play such files using FFmpeg's RASC decoder.

Since the vulnerability causes a use-after-free leading to a crash or potential arbitrary code execution, monitoring for crashes or abnormal behavior in FFmpeg when handling AVI files with the RIFF FourCC 'RASC' can help detect exploitation attempts.

There are no specific commands provided in the resources to detect this vulnerability directly on a network or system.

Mitigation Strategies

The immediate mitigation step is to apply the patch that fixes the vulnerability by introducing a dedicated scratch buffer for type-0 pixel copy operations in the RASC decoder.

This patch prevents the use-after-free condition by ensuring that the shared buffer is not disturbed during move-table processing.

If patching is not immediately possible, avoid opening or processing untrusted or suspicious AVI files containing RASC video streams with FFmpeg.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12706. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart