Skip to main content

FFmpeg CVE-2026-70630

| EUVDEUVD-2026-54162 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-08-06 disclosure@vulncheck.com GHSA-7mrq-j773-6867
Information Disclosure Ffmpeg
6.8
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.5 MEDIUM

Local vector because exploitation requires processing a supplied file; PR:N and UI:R since no authentication is needed but a user/process must trigger decoding; C:H for heap content disclosure; no integrity or availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 06, 2026 - 23:20 vuln.today
Patch available
Aug 06, 2026 - 23:03 EUVD
CVE Published
Aug 06, 2026 - 22:18 cve.org
MEDIUM 6.8

DescriptionCVE.org

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.

AnalysisAI

Uninitialized heap memory read in FFmpeg's native Screenpresso decoder (libavcodec/screenpresso.c) allows an attacker who can supply crafted SPV1-encoded video to recover stale heap contents - including userspace addresses and prior-frame data - from the process decoding the media. Affected versions span FFmpeg 3.0 through 8.x; version 9.0 resolves the issue via upstream commits and PR #23896. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the information-disclosure primitive is particularly dangerous in persistent server-side decoding pipelines where heap residue from earlier operations may include sensitive material.

Technical ContextAI

FFmpeg's libavcodec implements a native decoder for the Screenpresso screen-capture format (codec tag SPV1) in screenpresso.c. Each frame is transmitted as a zlib-compressed bitstream; the decoder inflates it into a persistent, pre-allocated buffer ctx->inflated_buf sized to the full frame dimensions. The root cause is CWE-908 (Use of Uninitialized Resource): screenpresso_decode_frame() calls zlib inflate to decompress the packet but does not validate that the number of output bytes produced equals the expected full-frame byte count. It then unconditionally passes the full frame width/height to av_image_copy_plane(), which copies the complete buffer - including any unwritten tail bytes left over from prior heap allocations or prior frames - into the decoded picture output. The persistent nature of ctx->inflated_buf means that content from previous decode calls (potentially for different input files or clients in a server context) can be disclosed. Affected CPE: all FFmpeg releases from 3.0 up to but not including 9.0.

RemediationAI

Upgrade to FFmpeg 9.0 or any release incorporating the three upstream commits referenced in the NVD entries (705890061467ad550ecc1dad5eea07f28ccfb43e, 9a3202a98b2e095b54dd784c3e01a09a676fc3fa, c22667d0fd7916a33fd3e79685b7246fc48f1a62) and PR #23896 at https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896. Distribution maintainers should backport these commits to supported stable branches where 9.0 is not yet packaged. As a compensating control where patching is immediately impractical: disable Screenpresso/SPV1 decoder support at build time (remove or restrict the screenpresso decoder from libavcodec) - note this breaks any legitimate Screenpresso content processing. For server-side pipelines, restrict accepted input container formats and codec IDs at the ingestion layer to exclude SPV1; this reduces attack surface without requiring a rebuild but requires careful input validation to avoid bypass. In high-sensitivity environments processing untrusted media, run FFmpeg in a sandboxed process (seccomp, containers with dropped capabilities) to limit the utility of any leaked addresses.

More in Ffmpeg

View all
CVE-2016-1897 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
CVE-2017-9993 HIGH
7.5 Jun 28

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
CVE-2016-1898 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
CVE-2013-4265 CRITICAL POC
10.0 Nov 23

The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
CVE-2020-12284 CRITICAL POC
9.8 Apr 28

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
CVE-2026-58049 HIGH POC
8.8 Jun 28

Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
CVE-2021-38094 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
CVE-2021-38093 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
CVE-2021-38092 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
CVE-2021-38091 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
CVE-2021-38090 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
CVE-2021-30123 HIGH POC
8.8 Apr 07

FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

CVE-2026-70630 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy