CVE-2026-12706: Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()
A 16-byte heap use-after-free read was found in FFmpeg's RASC video decoder (libavcodec/rasc.c), in the decodemove() function.
When processing a MOVE chunk with zlib compression enabled (compression == 1), decodezlib() decompresses data into the s->delta buffer and a GetByteContext (mc) is initialized pointing into it. During the move-processing loop, a type-0 move entry calls avfastpaddedmalloc(&s->delta, &s->deltasize, whs->bpp), which frees and reallocates the buffer when the requested size (e.g. 1600 bytes for a 20x20 32bpp move) exceeds s->deltasize (134 bytes after the initial inflate). The mc pointer is left dangling, and the next loop iteration performs 7 bytestream2getle16(&mc) calls and one bytestream2skip(&mc, 2), reading 16 bytes total from freed heap memory.
The RASC decoder is enabled by default (CONFIGRASCDECODER=yes) and is triggered automatically when demuxing AVI files with the RIFF FourCC ('R','A','S','C'). No special flags or codec selection is needed; user interaction is required to open or play the crafted file.
The proven impact is denial of service (deterministic crash on ASan/hardened-allocator builds). On standard glibc, behavior depends on heap reuse patterns.
Affected: FFmpeg (all versions containing the RASC decoder through current HEAD). The reporter verified on FFmpeg master (commit 78da965).
Fix: PR #22992 by Michael Niedermayer, applied to FFmpeg master. The fix introduces a dedicated scratch buffer (s->mvscratch) for the type-0 pixel copy so s->delta and mc are not disturbed. Patch: https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/ Mailing list: https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/
Reporter: Seung Min Shin (credited as Found-by in the upstream patch) PSIRT Ticket: PSIRTSUPT-11278
Other sources
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decodemove() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FFmpegto a version that resolves this vulnerability.Patch PR #22992
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12706?
The severity of CVE-2026-12706 is rated medium with a score of 6.5.
How do I fix CVE-2026-12706?
To fix CVE-2026-12706, update to the latest version of FFmpeg that has addressed the use-after-free vulnerability.
What is the impact of CVE-2026-12706?
The impact of CVE-2026-12706 could allow an attacker to exploit the vulnerability and potentially execute arbitrary code or crash the application.
What components of FFmpeg are affected by CVE-2026-12706?
CVE-2026-12706 specifically affects the RASC video decoder within FFmpeg.
Is CVE-2026-12706 a type of buffer overflow vulnerability?
CVE-2026-12706 is classified as a use-after-free vulnerability, not a buffer overflow.