FFmpeg RASC/DLTA Codec Exploitation - Suspicious Child Process or Suspicious Input Path

Ibrahim Saud@tektrix

•updated Jun 29, 2026•2•0•3

Detects potential exploitation of FFmpeg via memory corruption vulnerabilities in RASC or DLTA codecs. The rule monitors for two indicators: FFmpeg spawning unexpected child processes (e.g., cmd.exe, PowerShell, calc.exe) after media processing, or FFmpeg being invoked with RASC/DLTA codec flags while processing media files located in common user-writable directories (Temp, Downloads, AppData).