CVE-2026-12706: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-12706 is a heap use-after-free vulnerability in FFmpeg's RASC video decoder (libavcodec/rasc.c) that can cause a denial of service when a user opens a specially crafted AVI file. The decode_move() function initializes a read pointer (mc) into a decompressed buffer (s->delta), but a subsequent av_fast_padded_malloc() call during move-table processing reallocates that buffer, leaving mc dangling. The vulnerability affects all FFmpeg versions containing the RASC decoder through the current HEAD at the time of disclosure (verified on commit 78da965). It was reported by Seung Min Shin, disclosed on June 19, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a use-after-free (CWE-416) in decode_move() within libavcodec/rasc.c. When processing a MOVE chunk with zlib compression enabled (compression == 1), decode_zlib() decompresses data into s->delta and a GetByteContext (mc) is initialized pointing into it. During the move-processing loop, a type-0 move entry triggers av_fast_padded_malloc(&s->delta, &s->delta_size, w*h*s->bpp), which frees and reallocates s->delta when the requested size exceeds the current allocation — leaving mc as a dangling pointer. The next loop iteration then performs 7 bytestream2_get_le16(&mc) calls and one bytestream2_skip(&mc, 2), reading 16 bytes total from freed heap memory. The RASC decoder is enabled by default (CONFIG_RASC_DECODER=yes) and is triggered automatically when demuxing AVI files with the RIFF FourCC ('R','A','S','C'), requiring no special flags — only user interaction to open the file (Red Hat Bugzilla, GitHub Advisory). The fix (PR #22992 by Michael Niedermayer) introduces a dedicated scratch buffer (s->mv_scratch) for type-0 pixel copies so that s->delta and mc are not disturbed (FFmpeg Patchwork).

The confirmed impact is denial of service via a deterministic crash on ASan/hardened-allocator builds; on standard glibc, behavior depends on heap reuse patterns and could vary. There is no confidentiality or integrity impact — the vulnerability only affects availability. Affected Red Hat products include ffmpeg packages and several RHELAI3 bootc container images (AWS/Azure/GCP CUDA and ROCm variants), while nv-codec-headers and rhoai/odh-openvino-model-server-rhel9 are listed as unaffected (Red Hat Bugzilla, GitHub Advisory).

1. Craft a malicious AVI file: Create an AVI file with the RIFF FourCC ('R','A','S','C') that contains a RASC video stream with a MOVE chunk where zlib compression is enabled (compression == 1).
2. Engineer the move-table: Structure the MOVE chunk so that a type-0 move entry is encountered during processing, with dimensions (e.g., 20x20 at 32bpp = 1600 bytes) that exceed the initial s->delta allocation size (e.g., 134 bytes after the initial inflate), triggering av_fast_padded_malloc() to free and reallocate s->delta.
3. Deliver the file to the target: Send the crafted AVI file to a victim via email attachment, web download, or shared storage — any vector that results in the user opening or playing the file with an FFmpeg-based application.
4. Trigger the crash: When the victim opens the file, FFmpeg's RASC decoder automatically processes the stream. The dangling mc pointer reads 16 bytes from freed heap memory, causing a crash (denial of service) on hardened builds or undefined behavior on standard glibc (Red Hat Bugzilla, GitHub Advisory).

• File System: Unexpected or unsolicited AVI files delivered via email, downloads, or shared drives, particularly those with unusual RIFF structure or very small RASC video dimensions.
• Process: FFmpeg-based processes (e.g., ffmpeg, ffplay, media player backends) crashing with segmentation faults or heap corruption errors when opening AVI files.
• Logs: ASan or crash reports referencing libavcodec/rasc.c in the decode_move() function; stack traces involving bytestream2_get_le16 or av_fast_padded_malloc in the RASC decoder code path.

The upstream fix is FFmpeg PR #22992 (by Michael Niedermayer), which has been applied to FFmpeg master and introduces a dedicated s->mv_scratch buffer to prevent the dangling pointer condition (FFmpeg Patchwork, FFmpeg Mailing List). Users should update FFmpeg to a version that includes this patch. As a workaround where patching is not immediately possible, administrators can disable the RASC decoder at build time (CONFIG_RASC_DECODER=no) or restrict processing of untrusted AVI files through application-level controls. Red Hat has acknowledged affected products and users should monitor Red Hat advisories for updated packages (Red Hat CVE).