USN-8750-1: FFmpeg vulnerabilities
Ubuntu USN-8750-1 fixes multiple FFmpeg memory-handling flaws that allow denial of service via crafted files.
Ubuntu Security Notice USN-8750-1 patches several FFmpeg vulnerabilities related to incorrect memory operations, reported by Seung Min Shin, Xinghang Lv, and others. If a user or automated system is tricked into opening a specially crafted file, an attacker could cause a denial of service. Affected CVEs include CVE-2026-12706, CVE-2026-30999, and CVE-2026-58049.
- Multiple FFmpeg memory-handling flaws patched in Ubuntu USN-8750-1
- Crafted files could trigger denial of service for users or automated systems
- Includes CVE-2026-12706, CVE-2026-30999, CVE-2026-58049
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-12706 | A use-after-free vulnerability was found in FFmpeg's RASC video decoder. A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash). NVD description · AI analysis pending | 6.5 | <1% | — | — | ||
| CVE-2026-30999 | A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. NVD description · AI analysis pending | 7.5 | <1% | PoC |
| — | |
| CVE-2026-58049 | FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and va FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption. NVD description · AI analysis pending | 8.8 | <1% | — | — |
Seung Min Shin discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-12706) Xinghang Lv discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-30999) It was discovered that FFmpeg did not correctly handle certain memory operations. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service. (CVE-2026-58049) Adrian…
This source does not provide full text. Read it at ubuntu.com.