FFmpeg CVE-2026-70632

The primary fix is to upgrade FFmpeg to version 9.0 or later, which removes the out-of-bounds write by enforcing the non-Bayer output-width invariant in cfhd_decode(). The upstream fix is available as three commits (1006a2151236, 16b2049d4d52, db05df9d135f) and PR #23898 at code.ffmpeg.org; a formally tagged stable release version was not independently confirmed from the provided references - verify with the FFmpeg project release page before deploying in production. Downstream package maintainers should backport all three commits as a set, since they appear to address the flaw across multiple code paths in the CFHD decoder. Where immediate upgrade is not feasible, the most effective compensating control is to prevent untrusted or externally sourced AVI files from reaching any FFmpeg process; implementing input allowlisting at the ingestion layer (e.g., rejecting AVI containers or CFHD-encoded streams before they reach the decoder) eliminates the attack surface with the trade-off of rejecting legitimate GoPro CineForm content. Sandboxing the FFmpeg process using seccomp-bpf profiles or containers with restricted syscall surfaces limits the blast radius of a successful heap corruption exploit but does not prevent exploitation itself. For custom FFmpeg builds, disabling the CFHD decoder at compile time (removing libavcodec/cfhd.c from the build) fully eliminates exposure at the cost of losing GoPro CineForm decoding capability.