FFmpeg's RASC video decoder contains a flaw that allows a bitstream-controlled, out-of-bounds heap write and adjacent read. The decoder performs 32-bit reads and writes at the row cursor before the next line boundary check and validates the DLTA region in pixel units rather than bytes, meaning that a DLTA run on a PAL8 frame can access bytes beyond the row allocation. This corrupts memory and can lead to arbitrary code execution or a denial-of-service.

Any deployment that employs the FFmpeg library with an unpatched RASC decoder is impacted. The CVE does not exhibit explicit version constraints, but the problem exists in all releases that contain the vulnerable code until a patch is applied. Systems that accept media streams with the RASC FourCC, such as AVI or MKV containers, are susceptible because the vulnerability is triggered by a crafted media file.

The CVSS score of 8.8 indicates a high severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by delivering a malicious media file that contains the RASC FourCC and a specially crafted DLTA region, leading to memory corruption. The impact could be leveraged for elevated privilege execution if the decoding process runs with sufficient rights, although no public exploit is known at present.