High

Out-of-bounds heap write in FFmpeg RASC video decoder

IdentifiersCVE-2026-58049CWE-787· Out-of-bounds Write

CVE-2026-58049 is a memory corruption vulnerability in FFmpeg’s RASC video decoder, specifically in the decode_dlta() function in libavcodec/rasc.c. The flaw arises because the decoder performs 32-bit reads and writes at the current row cursor before enforcing the NEXT_LINE row-boundary check, and because the DLTA region is validated in pixel units rather than byte units. On PAL8 frames, this mismatch can allow a DLTA run to access several bytes beyond the allocated row buffer. A crafted media stream using the RASC FourCC can therefore trigger a bitstream-controlled out-of-bounds heap write together with an adjacent out-of-bounds read during decoding, resulting in heap memory corruption.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause heap memory corruption through attacker-controlled out-of-bounds writes and adjacent out-of-bounds reads during media decoding. This can lead to process crashes and may enable further exploitation, including potential arbitrary code execution, depending on allocator behavior, memory layout, and surrounding mitigations. The vulnerability is described as remotely exploitable via crafted media content processed by libavcodec.

Mitigation

If you can’t patch tonight, do this now.

Until patched versions are deployed, disable or avoid decoding media streams that use the RASC codec where feasible, especially in network-facing or automated media-processing workflows. Restrict exposure by sandboxing media decoding components, isolating untrusted content processing, and limiting acceptance of untrusted or externally supplied media files. Additional input validation or transcoding through trusted pipelines may reduce exposure but does not replace patching.

Remediation

Patch, then assume compromise.

Upgrade FFmpeg or libavcodec to a version containing the vendor fix for CVE-2026-58049. Where upstream patches are available, apply the patch addressing the RASC decoder boundary handling in decode_dlta() and the DLTA region validation logic. Downstream consumers should ensure their bundled FFmpeg/libavcodec builds are updated as well.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

FfmpegFfmpegapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

infosecurity magazine newsNews

Jul 2, 2026

Researcher Explains Release of Undisclosed Zero-Day Exploits - Infosecurity Magazine

A memory corruption vulnerability involving heap write/read in FFmpeg's RASC video decoder.

cvefeed high severityNews

Jun 28, 2026

CVE-2026-58049 - FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()

An out-of-bounds heap write and adjacent out-of-bounds read vulnerability in FFmpeg's RASC decoder (decode_dlta in libavcodec/rasc.c) that can be triggered by a crafted media stream, leading to memory corruption.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity9