Veille CVE

‹ Retour à la liste

CVE-2026-12706

6.5 Moyenne

Publiée le 19/06/2026 à 14:16 · Modifiée le 22/06/2026 à 22:16 · En attente d'analyse NVD · Source : secalert@redhat.com

Description

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 6.5 Moyenne secalert@redhat.com CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Faiblesses (CWE)

Références

Ailleurs