#cve

05 Aug 2026·9 min read

i fixed a bug that lived in ffmpeg for 8 years

RowSpill (CVE-2026-58049): root-causing, scaling, and patching a heap out-of-bounds write that sat in FFmpeg's RASC DLTA decoder for eight years.