CVE-2026-12706: FFmpeg RASC Use-After-Free Vulnerability

CVE-2026-12706 Overview

CVE-2026-12706 is a use-after-free vulnerability [CWE-416] in the RASC video decoder of FFmpeg. The flaw resides in the decode_move() function, which initializes a read pointer into a decompressed buffer. A subsequent reallocation of the same buffer during move-table processing leaves that pointer dangling. When the decoder dereferences the stale pointer, it reads from freed heap memory.

An attacker can trigger the condition by supplying a crafted AVI file containing a malicious RASC video stream. Opening or playing the file causes the decoder to access freed memory, resulting in a denial of service through a process crash.

Critical Impact
A crafted AVI file with a malicious RASC stream causes FFmpeg to dereference freed heap memory, leading to a denial of service when the file is opened or played.

Affected Products

FFmpeg (RASC video decoder component)
Downstream distributions packaging FFmpeg — refer to the Red Hat CVE Advisory for distribution-specific status
Applications and media frameworks that embed FFmpeg's libavcodec for AVI/RASC decoding

Discovery Timeline

2026-06-19 - CVE-2026-12706 published to the National Vulnerability Database (NVD)
2026-06-22 - Last updated in NVD database
2026-06-25 - EPSS score published at 0.245% (percentile 15.54)

Technical Details for CVE-2026-12706

Vulnerability Analysis

The vulnerability is a heap use-after-free in FFmpeg's RASC video decoder, classified under [CWE-416]. The RASC decoder decompresses input data into a heap buffer and then performs additional parsing passes over that buffer. During the move-table processing stage, the decoder reallocates the decompressed buffer to accommodate new data. The reallocation can move the underlying allocation to a different address, invalidating any pointers that were captured before the call.

The decode_move() function captures a read pointer into the decompressed buffer prior to this reallocation event. After the buffer is resized, the function continues reading through the stale pointer, which now references freed heap memory. The dereference produces undefined behavior, and in practice triggers a process crash when the freed region has been reused or unmapped.

Exploitation requires user interaction: the victim must open or play a crafted AVI file. Impact is limited to availability — there is no direct path to information disclosure or code execution described in the upstream report.

Root Cause

The root cause is the failure to refresh a cached buffer pointer after a reallocation. The decoder treats the decompressed buffer as stable for the duration of decode_move(), but the move-table processing path mutates that buffer's backing storage. Any pointer derived from the buffer's base address before the reallocation becomes dangling once the allocator returns a different region.

Attack Vector

The attacker delivers a malicious AVI container carrying a crafted RASC video stream. Delivery channels include web downloads, email attachments, messaging platforms, and shared media libraries that are processed by FFmpeg-based pipelines. The victim must open or play the file with an application that invokes the vulnerable decoder. Server-side media-processing pipelines that automatically decode uploaded video are also exposed.

For technical details, refer to the FFmpeg Development List Message and the corresponding FFmpeg Patch Submission.

Detection Methods for CVE-2026-12706

Indicators of Compromise

Unexpected crashes of FFmpeg, ffplay, ffprobe, or applications linking libavcodec when processing AVI input
AVI files containing RASC-encoded video streams originating from untrusted sources
Repeated decoder faults in media-processing services correlated with the same input file

Detection Strategies

Monitor host telemetry for abnormal termination of media processes (SIGSEGV, SIGABRT) tied to FFmpeg binaries or libraries
Inspect AVI uploads in ingestion pipelines and flag files declaring the RASC FourCC video codec for additional sandboxed validation
Enable AddressSanitizer (ASan) or heap-checking allocators in pre-production media pipelines to catch use-after-free reads during file fuzzing

Monitoring Recommendations

Log process exit codes and stack traces from FFmpeg invocations in server-side transcoding workflows
Alert on sustained increases in decoder crash rates within media services, which can indicate scripted abuse for denial of service
Track FFmpeg package versions across the fleet and correlate crash events with unpatched hosts

How to Mitigate CVE-2026-12706

Immediate Actions Required

Update FFmpeg and any embedded libavcodec copies to a version that includes the upstream RASC decoder fix referenced in the FFmpeg Patch Submission
Rebuild and redistribute downstream applications that statically link FFmpeg once a fixed version is available
Restrict automatic decoding of AVI files from untrusted sources until patches are deployed

Patch Information

A fix has been proposed on the FFmpeg development mailing list and submitted via Patchwork. Track the upstream status through the FFmpeg Development List Message, the FFmpeg Patch Submission, and the Red Hat Bug Report for distribution backports.

Workarounds

Disable the RASC decoder in custom FFmpeg builds by omitting it during ./configure (for example, --disable-decoder=rasc) where the codec is not required
Run media decoding in a sandbox or short-lived container so that a decoder crash does not impact the host service
Validate container and codec metadata before invoking FFmpeg, and reject AVI streams declaring the RASC codec from untrusted users

bash

# Configuration example: build FFmpeg without the RASC decoder
./configure --disable-decoder=rasc
make -j"$(nproc)"
make install

# Verify the decoder is no longer available
ffmpeg -hide_banner -decoders | grep -i rasc || echo "RASC decoder disabled"