Homepage

Out-of-bounds Write The advisory has been revoked - it doesn't affect any version of package ffmpeg  (opens in a new tab)

Threat Intelligence

EPSS
0.5% (40th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-FFMPEG-17703149
  • published30 Jun 2026
  • disclosed28 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 28 Jun 2026

CVE-2026-58049  (opens in a new tab)
CWE-787  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ffmpeg package and not the ffmpeg package as distributed by RHEL.

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.

References