https://umar.ac/blog Long-form notes from reverse engineering sessions, parser archaeology and the occasional crash that turned out to be interesting. en-us https://umar.ac/blog/i-fixed-a-bug-that-lived-in-ffmpeg-for-8-years https://umar.ac/blog/i-fixed-a-bug-that-lived-in-ffmpeg-for-8-years RowSpill (CVE-2026-58049): root-causing, scaling, and patching a heap out-of-bounds write that sat in FFmpeg's RASC DLTA decoder for eight years. Wed, 05 Aug 2026 00:00:00 GMT security ffmpeg c cve