05 Aug 2026·9 min read·featuredi fixed a bug that lived in ffmpeg for 8 yearsRowSpill (CVE-2026-58049): root-causing, scaling, and patching a heap out-of-bounds write that sat in FFmpeg's RASC DLTA decoder for eight years.securityffmpegccve
