High [CVE-2026-58049] Memory corruption via crafted RASC video stream

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation.

A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption. A remote attacker could exploit this by providing a crafted media stream using the RASC FourCC (Four Character Code), which is then decoded by libavcodec.

This can result in a denial of service or potentially arbitrary code execution. Red Hat products utilizing FFmpeg for RASC video decoding are at risk if they process untrusted media content.

Red Hat severity: Important — CVSS 7.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H). Weakness: CWE-787.

Affected Red Hat products: Red Hat Enterprise Linux AI 3.0 for RHEL 9; Red Hat Enterprise Linux AI 3.2 for RHEL 9; Red Hat Enterprise Linux AI 3.3 for RHEL 9; Red Hat Enterprise Linux AI 3.5 for RHEL 9; Red Hat AI Inference Server 3.2; Red Hat AI Inference Server 3.3; Red Hat OpenShift AI 3.4; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).

Red Hat lists Red Hat OpenShift AI (RHOAI) as not affected.