CVE-2026-12706
Fixed in a distro release EPSS <1%CVSS 6.5
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).
Products: Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI)
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ffmpeg | 7:5.1.9-0+deb12u1 |
| Debian 13 | ffmpeg | 7:7.1.4-0+deb13u1 |
| Debian 14 | ffmpeg | 7:8.1.1-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | ffmpeg-4 | 4.4.8-150400.3.72.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | ffmpeg-4 | 4.4.8-150400.3.72.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | ffmpeg-4 | 4.4.8-150600.13.52.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | ffmpeg-4 | 4.4.8-150400.3.72.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | ffmpeg-4 | 4.4.8-150400.3.72.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | ffmpeg-4 | 4.4.8-150600.13.52.1 |
| Ubuntu 25.10 | ffmpeg | no fix |
| Ubuntu 26.10 | ffmpeg | no fix |
| Ubuntu Pro 14.04 LTS | libav | no fix |
| Ubuntu Pro 16.04 LTS | ffmpeg | no fix |
| Ubuntu Pro 18.04 LTS | ffmpeg | no fix |
| Ubuntu Pro 20.04 LTS | ffmpeg | 7:4.2.7-0ubuntu0.1+esm17 |
| Ubuntu Pro 22.04 LTS | ffmpeg | 7:4.4.2-0ubuntu0.22.04.1+esm16 |
| Ubuntu Pro 24.04 LTS | ffmpeg | no fix |
| Ubuntu Pro 26.04 LTS | ffmpeg | no fix |
| openSUSE Leap 16.0 | ffmpeg-7 | 7.1.5-160000.1.1 |
| openSUSE Tumbleweed | ffmpeg-4 | 4.4.8-2.1 |
| openSUSE Tumbleweed | ffmpeg-7 | 7.1.4-5.1 |
| openSUSE Tumbleweed | ffmpeg-8 | 8.1.2-2.1 |
| openSUSE Tumbleweed | ffmpeg-9 | 9.0.1-1.1 |