Loading story…
A high-severity vulnerability tracked as CVE-2026-58049 affects FFmpeg’s RASC video decoder in libavcodec/rasc.c, where the decode_dlta() function performs 32-bit reads and writes before enforcing a row-boundary check. The flaw is compounded by validating the DLTA region in pixel units rather than byte units, allowing a crafted media stream using the RASC FourCC to access several bytes past a PAL8 frame row allocation. Security advisories say the bug can trigger a bitstream-controlled heap out-of-bounds write and an adjacent out-of-bounds read during decoding, leading to memory corruption and potential remote exploitation.
A public proof of concept demonstrates the issue on FFmpeg upstream code and shows how DLTA run handlers can write past a 64-byte PAL8 frame row boundary. The PoC uses a custom buffer callback to place a function pointer next to the frame buffer, then overwrites the low bytes of that pointer through a crafted DLTA run to redirect execution, while AddressSanitizer reports a heap-buffer-overflow in decode_dlta(). Reported mitigations include updating FFmpeg, applying vendor patches, and moving row-boundary validation ahead of every 32-bit access with stricter checks such as ensuring cx + 4 <= w * s->bpp.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub proof of concept was published demonstrating exploitation of the FFmpeg libavcodec RASC decoder bug on upstream master. The PoC shows how a crafted bitstream can overwrite a nearby callback pointer and redirect execution, with AddressSanitizer output confirming a heap-buffer-overflow in decode_dlta().
A high-severity vulnerability affecting FFmpeg's RASC video decoder decode_dlta() function was disclosed. The flaw allows a crafted RASC media stream to trigger a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read during decoding, leading to memory corruption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FFmpeg patched **CVE-2026-8461**, a high-severity heap out-of-bounds write flaw dubbed **PixelSmash** in the `libavcodec` **MagicYUV** decoder. The bug is triggered by an odd `slice_height` condition while parsing malicious **AVI**, **MKV**, or **MOV** files and affects FFmpeg versions before **8.1.2**. The vulnerability can cause denial of service and, in some environments, lead to remote code execution. JFrog reported that applications embedding FFmpeg are exposed through their media-processing pipelines, and demonstrated full remote code execution against **Jellyfin 10.11.9** via its automated media library scan workflow, although successful RCE required **ASLR** to be disabled or bypassed. **Nextcloud** was also identified as potentially vulnerable under additional conditions, while **Plex** appears largely protected by a restricted custom FFmpeg build. Organizations using FFmpeg directly or through downstream products have been urged to upgrade to **FFmpeg 8.1.2 or later** and apply vendor patches because the decoder’s broad adoption creates a notable supply-chain exposure.
Jun 29, 2026
Cisco Talos disclosed four heap-based buffer overflow vulnerabilities in the MediaArea **MediaInfoLib** library affecting version `26.01`. The flaws, tracked as `CVE-2026-25104`, `CVE-2026-25713`, `CVE-2026-28764`, and `CVE-2026-22554`, were discovered by Dimitrios Tatsis and mapped by Talos to `TALOS-2026-2367`, `TALOS-2026-2368`, `TALOS-2026-2371`, and `TALOS-2026-2374`. Talos said the vulnerabilities can be triggered when an attacker supplies a specially crafted media file, potentially leading to arbitrary code execution in affected environments. MediaArea has patched the issues under Cisco’s third-party vulnerability disclosure process, and Talos said updated **Snort** rule sets are available to help defenders detect exploitation attempts targeting the library.
Jun 29, 2026
A technical writeup detailed how a flaw in andyherbert’s `lz1`/`lz77` decompression routine can be exploited to achieve remote code execution by supplying crafted compressed data. The bug arises because the decompressor limits `coding_pos` using `uncompressed_size`, but an inner copy loop continues incrementing `coding_pos` without enforcing the same boundary, allowing writes past the end of `uncompressed_text`. The first four bytes of attacker-controlled input determine `uncompressed_size`, and pointer metadata such as length can then be abused to trigger an out-of-bounds write. The demonstrated exploitation path replaced heap allocation with stack allocation using `alloca`, turning the overflow into a stack-based attack capable of overwriting adjacent variables, saved frame data, and the return address. In a statically compiled, non-PIE `amd64` binary, the exploit used a ROP chain to call `_dl_make_stacks_executable`, pivoted execution with a `jmp rsp` gadget, and ran shellcode that opened a reverse shell. The author noted that earlier fuzzing with `afl-fuzz` had already uncovered crashing inputs tied to the vulnerable logic.
Jun 29, 2026