Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-12706 Use-After-Free Vulnerability in FFmpeg RASC Video Decoder Decode Function https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-12706
Post summary
A use‑after‑free flaw in the FFmpeg RASC codec decoder has been disclosed and a link to the vulnerability details is provided.