CVE-2026-58049

🗓️ 28 Jun 2026 01:32:52Reported by VulnCheckType

CVE-2026-58049: FFmpeg RASC decoder reads beyond row boundary, causing out-of-bounds heap write and memory corruption on PAL8 frames.

Reporter	Title	Published	Views	Family All 18
ATTACKERKB	CVE-2026-58049	28 Jun 202601:32	–	attackerkb
BDU FSTEC	The vulnerability of the decode_dlta() function in the libavcodec/rasc.c file of the RASC video decoder from the FFmpeg multimedia library allows a attacker to cause a service failure.	30 Jun 202600:00	–	bdu_fstec
Circl	CVE-2026-58049	28 Jun 202602:49	–	circl
Cvelist	CVE-2026-58049 FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()	28 Jun 202601:32	–	cvelist
Debian CVE	CVE-2026-58049	28 Jun 202601:32	–	debiancve
EUVD	EUVD-2026-39969	28 Jun 202601:32	–	euvd
NVD	CVE-2026-58049	28 Jun 202602:16	–	nvd
OSV	DEBIAN-CVE-2026-58049	28 Jun 202602:16	–	osv
OSV	ECHO-D121-7767-849C	2 Jul 202612:49	–	osv
OSV	UBUNTU-CVE-2026-58049	28 Jun 202602:16	–	osv

Vulners

CNA

Node

ffmpeg ffmpegRange0–bcd2c69e087a09b07cf45c6bd2428ee1ccb2925c

[
  {
    "vendor": "FFmpeg",
    "product": "FFmpeg",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "git",
        "lessThanOrEqual": "bcd2c69e087a09b07cf45c6bd2428ee1ccb2925c"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta
github	www.github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc
github	www.github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json
access	www.access.redhat.com/security/cve/CVE-2026-58049
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

15 Jul 2026 01:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.6

CVSS 48.8

EPSS0.00217

SSVC

CWE-787