CVE-2026-58049 — ffmpeg
CVE-2026-58049 is a Out-of-bounds Write vulnerability. No vendor fix is recorded yet; mitigation options are listed below.
FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-58049.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Description
FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.
Detection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
No fixed release is recorded for CVE-2026-58049 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
The vulnerability in FFmpeg's RASC video decoder is rated as Important. This flaw allows a remote attacker to cause memory corruption, potentially leading to denial of service or arbitrary code execution, by providing a specially crafted media stream. Red Hat products utilizing FFmpeg for RASC video decoding are at…
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.Source: Red Hat security advisory for CVE-2026-58049 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Enterprise Linux AI 3.0 for RHEL 9 | ffmpeg-0:6.1.6-3.el9ai | RHSA-2026:52832 |
| Red Hat Enterprise Linux AI 3.0 for RHEL 9 | ffmpeg-0:6.1.6-9.el9ai | RHSA-2026:74089 |
| Red Hat Enterprise Linux AI 3.2 for RHEL 9 | ffmpeg-0:6.1.6-3.el9ai | RHSA-2026:52833 |
| Red Hat Enterprise Linux AI 3.3 for RHEL 9 | ffmpeg-0:6.1.6-3.el9ai | RHSA-2026:51180 |
| Red Hat Enterprise Linux AI 3.5 for RHEL 9 | ffmpeg-0:6.1.6-1.el9ai | RHSA-2026:43711 |
| Red Hat AI Inference Server 3.2 | rhaiis/vllm-cuda-rhel9:1787860580 | RHSA-2026:61627 |
| Red Hat AI Inference Server 3.2 | rhaiis/model-opt-cuda-rhel9:1787772157 | RHSA-2026:61628 |
| Red Hat AI Inference Server 3.2 | rhaiis/vllm-rocm-rhel9:1787884873 | RHSA-2026:61629 |
Frequently Asked Questions
Is CVE-2026-58049 in your dependencies?
Find it across , including transitive dependencies.