Описание
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).
Отчет
This vulnerability is rated as Moderate severity because the proven impact is limited to denial of service through a heap read from freed memory. Exploitation requires user interaction: a victim must open or play a crafted AVI file containing a malicious RASC video stream. RASC is a screen-capture codec with limited real-world usage, which reduces the likelihood of encountering malicious RASC content in typical workflows. RHEL AI 3.4 ships FFmpeg 6.1.x as an RPM and embedded in bootc container images, and is affected. RHOAI 2.25, 3.3, and 3.4 embed FFmpeg in the vllm-gaudi container image and are affected. Fedora and EPEL ship FFmpeg as ffmpeg-free and are also affected. The RHOAI openvino-model-server images ship only the ffmpeg-python wrapper, which does not expose the RASC decoder code path and is not affected. The nv-codec-headers packages (rhel-br streams) contain only build headers with no FFmpeg library code and are not affected. The services-subscription-central deployment bundles FFmpeg as a transitive dependency but does not process user-supplied video content in a way that would reach the RASC decoder.
Меры по смягчению последствий
If the RASC decoder is not needed, it can be disabled at build time with --disable-decoder=rasc. There is no runtime workaround that disables the decoder without rebuilding FFmpeg.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) 3 | ffmpeg | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | nv-codec-headers | Not affected | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-aws-cuda-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-azure-cuda-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-azure-rocm-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-cuda-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-gcp-cuda-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-rocm-rhel9 | Fix deferred | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-openvino-model-server-rhel9 | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-vllm-gaudi-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).
A use-after-free vulnerability was found in FFmpeg's RASC video decode ...
A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).
EPSS
6.5 Medium
CVSS3