Threats Tagged 'cve-2026-12706'

CVE-2025-10256 is a medium-severity vulnerability in FFmpeg version 3.2 affecting the Firequalizer filter. It arises from a NULL pointer dereference caused by a missing check on the return value of av_malloc_array() in the config_input() function. Exploitation requires processing a crafted media file with the Firequalizer filter enabled, which can cause the application to crash and result in denial of service. There are no known exploits in the wild. No patch or official remediation details are provided in the available vendor advisory content.

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash).