CVE-2026-12706: FFmpeg RASC Decoder Use-After-Free Vulnerability

Technical summary

The vulnerability resides in FFmpeg's RASC video decoder, specifically in the decode_move() function. During video decompression, the function maintains a read pointer into a decompressed buffer. However, when the decoder processes move-table operations, the underlying buffer is reallocated without updating the pointer, leaving it dangling. Subsequent read operations dereference this freed memory, triggering a use-after-free condition (CWE-416). The flaw is reachable via untrusted AVI files containing RASC streams, making it accessible to remote attackers with minimal user interaction.

Business impact

Organizations relying on FFmpeg for media ingestion, transcoding, or playback face service disruption risk. Video processing pipelines, streaming platforms, and automated media handling systems could crash or become unavailable when encountering malicious files. While the vulnerability does not enable data theft or code execution, the denial-of-service impact affects availability—a critical concern for media-heavy workflows, broadcast systems, and content management platforms. Users processing untrusted video sources face the highest exposure.

Affected systems

All versions of FFmpeg that include the RASC video decoder are affected. The RASC codec is less common than H.264 or VP9, reducing the attack surface in many environments, but it remains present in standard FFmpeg distributions. Any application embedding FFmpeg—including media players, transcoding services, and multimedia toolkits—inherits this vulnerability. Verify your specific FFmpeg version and build configuration against the vendor's security advisory to confirm exposure.

Exploitability

Exploitation requires minimal effort. An attacker crafts a malicious AVI file with a specially designed RASC video stream and distributes it via email, file-sharing platforms, or compromised websites. When a user or automated system opens or plays the file using FFmpeg, the use-after-free triggers, causing a crash. No network interaction occurs after the initial file delivery, and the attack requires only that the victim use common media-playing functionality. User interaction is necessary, but clicking a link or opening an attachment is a low barrier.

Remediation

Update FFmpeg to a patched version released after the vulnerability disclosure (June 19, 2026). Check the FFmpeg project's security advisories and release notes for the specific version that resolves CVE-2026-12706. If immediate patching is not feasible, restrict processing of untrusted RASC video files, disable the RASC decoder if your application does not require it, and educate users to avoid opening video files from untrusted sources.

Patch guidance

Monitor the FFmpeg project's official releases and security page for a patch version. Once available, update your FFmpeg library and recompile any applications that depend on it. If you maintain a custom build, ensure the patched decoder source is included. For enterprise deployments, test the patch in a staging environment before rolling out to production to verify compatibility with your media pipeline and dependent applications.

Detection guidance

Monitor for FFmpeg crashes or unexpected terminations triggered by video file processing, particularly involving less common codecs. Log and alert on failed AVI file parsing or RASC decoder errors. If feasible, implement file type validation to reject or quarantine RASC-encoded files from untrusted sources. Network-based detection is limited since the malicious file content is the sole attack vector; focus on endpoint-level crash reporting and media processing logs.

Why prioritize this

While the CVSS score of 6.5 (Medium) reflects the denial-of-service nature and lack of code execution, the practical priority depends on your media processing footprint. Organizations heavily invested in FFmpeg for automated transcoding, broadcasting, or public-facing media services should prioritize patching to ensure service continuity. Those using FFmpeg in isolated, trusted environments face lower urgency. The low barrier to exploitation (a malicious file) and the ubiquity of FFmpeg in media stacks argue for timely remediation.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible attack vector, low attack complexity, no privilege requirement, and user interaction needed, resulting in high availability impact but no confidentiality or integrity breach. The 'Medium' severity appropriately captures that this is a serious denial-of-service risk without remote code execution potential. However, real-world priority should account for whether your organization processes untrusted video and relies on FFmpeg availability.

Frequently asked questions