Red Hat Security Advisory

RHSA-2026:43711

RHEL AI 3.5 RPM runtime CVE fix - ffmpeg

Released 2026-07-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AI 3.5 for RHEL 9 ffmpeg-6.1.6-1.el9ai, ffmpeg-free-rhai-6.1.6-1.el9ai, ffmpeg-free-rhai-devel-6.1.6-1.el9ai +16

Fixes 2 records

TI-2026-41804 CVE-2026-58049 · GHSA-mjxr-6gqf-w78h

FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()

MEDIUM 45

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00496 Published 2026-06-28 Partial fix CWE-787

TI-2026-07431 CVE-2026-8461 · GHSA-qff7-4q6c-m8h6

Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder

MEDIUM 43

An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01572 Published 2026-06-18 Partial fix · 8.1.2 CWE-787