ZeroHour
Ubuntu Security Noticespublished ()ingested

USN-8750-1: FFmpeg vulnerabilities

AI summary · glm-5.3

Ubuntu USN-8750-1 fixes multiple FFmpeg memory-handling flaws that allow denial of service via crafted files.

Ubuntu Security Notice USN-8750-1 patches several FFmpeg vulnerabilities related to incorrect memory operations, reported by Seung Min Shin, Xinghang Lv, and others. If a user or automated system is tricked into opening a specially crafted file, an attacker could cause a denial of service. Affected CVEs include CVE-2026-12706, CVE-2026-30999, and CVE-2026-58049.

  • Multiple FFmpeg memory-handling flaws patched in Ubuntu USN-8750-1
  • Crafted files could trigger denial of service for users or automated systems
  • Includes CVE-2026-12706, CVE-2026-30999, CVE-2026-58049

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2026-12706
A use-after-free vulnerability was found in FFmpeg's RASC video decoder.

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).

NVD description · AI analysis pending
6.5<1%
CVE-2026-30999
A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

NVD description · AI analysis pending
7.5<1% PoC
  • ffmpeg ffmpeg
CVE-2026-58049
FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and va

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.

NVD description · AI analysis pending
8.8<1%
Full article

Seung Min Shin discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-12706) Xinghang Lv discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-30999) It was discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-58049) Adrian…

This source does not provide full text. Read it at ubuntu.com.