Red Hat Security Advisory

RHSA-2026:51180

Backport fixes for CVE-2026-64835 and CVE-2026-58049

Released 2026-08-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AI 3.3 for RHEL 9 ffmpeg-6.1.6-3.el9ai, ffmpeg-free-rhai-6.1.6-3.el9ai, ffmpeg-free-rhai-devel-6.1.6-3.el9ai +16

Fixes 2 records

TI-2026-41804 CVE-2026-58049 · GHSA-mjxr-6gqf-w78h

FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta()

MEDIUM 45

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00496 Published 2026-06-28 Partial fix CWE-787

TI-2026-46360 CVE-2026-64835 · GHSA-p2v8-4c4f-rwpq

FFmpeg 4.4 - 8.1.2 Out-of-Bounds Memory Access in ADX Audio Decoder

MEDIUM 40

FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00496 Published 2026-07-22 Partial fix CWE-787