CVE-2026-12706 | A use-after-free vulnerability was found in FFmpeg's RASC vi… | CVSS 6.5 MEDIUM

Description

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).

Metadata

CVE ID: CVE-2026-12706
State: PUBLISHED
Assigner: redhat
Reserved: 2026-06-19 10:26 UTC
Published: 2026-06-19 10:55 UTC
Last updated: 2026-06-19 11:00 UTC
Primary CWE: CWE-416
Use After Free
Vendor / Product: Red Hat / Red Hat Enterprise Linux AI (RHEL AI) 3
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products (10)

Vendor	Product	Platform	Versions
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—	—
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	—	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—	—

Weakness (CWE)

CWE	Source	Description
CWE-416	cna	Use After Free

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.5	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References (4)