In FFmpeg libavcodec RASC decoder (decode_dlta in libavcodec/rasc.c), 32-bit row-cursor reads/writes occur before the NEXT_LINE boundary check, and DLTA validation uses pixel not byte units. A crafted RASC FourCC stream can trigger bitstream-controlled heap OOB write plus adjacent OOB read, causing memory corruption. Upgrade once an upstream fix is released. Until then, restrict or avoid decoding untrusted media/files with affected FFmpeg builds.