This vulnerability involves a use-after-free condition in the decode_move() function of FFmpeg's RASC video decoder. The function initializes a read pointer into a decompressed buffer, but subsequent reallocation of the buffer during move-table processing leaves the pointer dangling. When a specially crafted AVI file containing a malicious RASC video stream is opened or played, the decoder reads from freed heap memory, which can cause a denial of service (application crash). The vulnerability affects Red Hat Enterprise Linux AI (RHEL AI) 3. No specific affected versions or patch information is provided in the advisory.

Successful exploitation leads to a denial of service via application crash due to reading freed heap memory. There is no indication of confidentiality or integrity impact. The CVSS v3.1 score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and impact limited to availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12706 for current remediation guidance. No official fix or workaround is stated in the provided advisory content. Users should monitor the vendor advisory for updates and apply patches once available.