The FFmpeg bug behind the title is a memory-safety issue in the RASC video decoder, specifically its decode_dlta function. The GitHub Advisory Database identifies it as CVE-2026-58049 and describes a risk of out-of-bounds access and memory corruption when a crafted RASC stream is decoded. The advisory does not establish that the flaw existed for eight years, and it lists both affected and patched versions as unknown.
What the FFmpeg advisory says
The GitHub Advisory Database entry for CVE-2026-58049, published June 28, 2026 and updated August 7, 2026, names FFmpeg’s RASC decoder function decode_dlta. It says that 32-bit reads and writes can occur at a row cursor before the next-row boundary check, and that the DLTA region is validated in pixel rather than byte units. According to the advisory, a crafted RASC media stream can trigger out-of-bounds access and memory corruption.
As an Amazon Associate I earn from qualifying purchases.
The advisory assigns the issue a CVSS v4 base score of 8.8 and classifies it as CWE-787, out-of-bounds write. A score should be read together with its scoring version: a separate secondary result shows 8.6, but does not explain the difference. The advisory’s stated figure is 8.8 under CVSS v4.
How the DLTA parsing path creates the risk
RASC decoding processes DLTA data using a cursor and row pointers. In FFmpeg’s RASC decoder source, the NEXT_LINE macro handles row transitions, while the dlta_room helper checks whether cx + need <= w * bpp. Several run-type branches perform 32-bit operations through addresses based on b1 + cx or b2 + cx.
#1 Best Overall
The important distinction is between a check expressed in pixels and an operation that accesses bytes. If the cursor or required space is not validated in units that match the actual memory access, a check may permit an operation that crosses the row’s byte boundary. The advisory specifically says the 32-bit operations may occur before the next-row check and that region validation uses pixel rather than byte units.
The source provides implementation context for the advisory’s account; seeing these macros, checks, and operations is not by itself proof that a particular exploit succeeds. The vulnerability claim and its impact are stated by the advisory, not independently demonstrated by the code excerpt alone.
What is established—and what remains unverified
| Evidence | What it supports | What it does not establish |
|---|---|---|
| GitHub Advisory Database | CVE-2026-58049 concerns decode_dlta in FFmpeg’s RASC decoder; the advisory describes a possible out-of-bounds access and memory corruption, and reports CVSS v4 8.8 and CWE-787. |
The entry lists affected and patched versions as unknown; it does not establish a fixed release. |
| FFmpeg source | The decoder contains row-transition logic, a room-check helper, and 32-bit operations in DLTA run-type branches. | The source page alone does not prove that a specific crafted file exploits the issue or identify a fix. |
| Feedly search result | A secondary result reproduces the title and alleges a PAL8 proof of concept involving a 64-by-1 frame and an adjacent callback-pointer overwrite. | Those exploit details are not confirmed by the advisory or independently verified here. |
The “8 years” in the title should therefore be treated as a title-level claim, not a verified timeline: the available advisory, source page, and secondary result do not establish when the defect was introduced.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesIs there a fixed FFmpeg version?
Not one established by the advisory cited here. Its affected-version and patched-version fields are both unknown, and the available source page does not identify an upstream fix commit or fixed release. Do not infer that a particular current release is safe from this evidence alone. FFmpeg is also distributed through operating-system and application packages, where maintainers may apply fixes separately; check the relevant distributor’s security notice for the build you use.
Quick Recap
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
