FFmpeg RASC DLTA Codec Exploitation - Unexpected Child Process Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•6

Detects anomalous child process creation, suspicious command-line arguments, or the presence of specific file artifacts associated with the exploitation of heap corruption vulnerabilities in FFmpeg RASC/DLTA codecs (as demonstrated by the exploitarium FFmpeg-RASC-DLTA-calc-poc PoC).