A use‑after‑free flaw exists in FFmpeg’s RASC video decoder, specifically in the decode_move() function. During decoding, a pointer is set into a decompressed buffer and that buffer is reallocated later, leaving the pointer dangling. This weakness, identified as CWE‑416, can lead to the decoder reading freed heap memory, resulting in a crash. The vulnerability is therefore a denial‑of‑service in nature and does not provide an attacker with code execution capabilities.

Red Hat Enterprise Linux AI version 3 and Red Hat OpenShift AI are the products listed as affected. The vulnerability is tied to the FFmpeg component of these distributions; no specific sub‑versions are enumerated in the advisory.

The CVSS score of 6.5 places the issue in the moderate severity band. Because an EPSS score is not available, the exact likelihood of exploitation cannot be quantified, but the lack of a known exploit and exclusion from the CISA KEV catalog suggest current threat activity is low. An attacker must supply a crafted AVI file containing a malicious RASC video stream, and a user must open or play that file for the denial‑of‑service to occur. The attack vector is therefore local or remote delivery of a malicious file rather than a network‑based exploit. Overall, the risk is moderate but warranting timely remediation or mitigation.