Skip to main content

FFmpeg EUVDEUVD-2026-54161

| CVE-2026-70629 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-08-06 disclosure@vulncheck.com GHSA-824f-v6qw-342h
Information Disclosure Ffmpeg
6.8
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
6.8 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.5 MEDIUM

File must be locally processed (AV:L), attacker needs no privileges to supply crafted input (PR:N), passive user or service interaction required (UI:R); confidentiality impact only, no integrity or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 06, 2026 - 23:21 vuln.today
Patch available
Aug 06, 2026 - 23:03 EUVD
CVE Published
Aug 06, 2026 - 22:18 cve.org
MEDIUM 6.8

DescriptionCVE.org

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.

AnalysisAI

Heap memory disclosure in FFmpeg's native RSCC decoder (libavcodec/rscc.c) allows an attacker who can supply a crafted video file to expose residual heap contents - including data from prior heap allocations or previously decoded frames - to any downstream consumer of the decoded output. The flaw stems from rscc_decode_frame() calling av_image_copy_plane() without verifying that the number of decompressed bytes matches the declared tile geometry, allowing the unwritten suffix of the persistent ctx->inflated_buf to propagate silently into the output frame. All FFmpeg builds from 3.0 through 8.x are affected; no public exploit has been identified at time of analysis, and no KEV listing exists.

Technical ContextAI

FFmpeg's RSCC decoder handles the RealMedia Screen Capture Codec, a tile-based format used in screen recordings. The vulnerable function rscc_decode_frame() inflates compressed tile data via zlib into ctx->inflated_buf, a persistent heap buffer that is not zeroed between frames or between decode invocations. CWE-908 (Use of Uninitialized Resource) is the root cause class: after decompression, the code calls av_image_copy_plane() using the full declared tile dimensions rather than the actual decompressed byte count, so any unwritten suffix of inflated_buf - potentially containing stale heap data from prior allocations or prior decoded frames - is blindly copied into the output frame. The vulnerability spans all CPE-applicable FFmpeg versions from 3.0 to pre-9.0 as confirmed by ENISA EUVD-2026-54161. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N reflects a local file-processing flaw with no integrity or availability impact.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - the fix is present in upstream commits 533a619, a5fe21a, and cd1f545 on code.ffmpeg.org (PR #23895), but no tagged FFmpeg 9.0 release version was confirmed from the provided data. Organizations should apply these commits to their FFmpeg source tree and rebuild, or upgrade to FFmpeg 9.0 once it is officially released. As an immediate compensating control, rebuild FFmpeg with --disable-decoder=rscc to eliminate the vulnerable code path entirely; the trade-off is loss of RSCC decode capability, which is a niche screen-capture codec unlikely to be required in most production pipelines. For services that cannot be rebuilt immediately, implement strict input codec whitelisting using FFmpeg's -allowed_extensions and -codec options to reject RSCC-encoded files before they reach the decoder. Sandboxing the FFmpeg decoding process (via seccomp-bpf, bubblewrap, or containerization with no shared memory) limits the exploitability of any heap disclosure by preventing the leaked data from reaching sensitive co-resident memory.

More in Ffmpeg

View all
CVE-2016-1897 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol
CVE-2017-9993 HIGH
7.5 Jun 28

FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restric
CVE-2016-1898 MEDIUM POC
5.5 Jan 15

FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protoco
CVE-2013-4265 CRITICAL POC
10.0 Nov 23

The av_reallocp_array function in libavutil/mem.c in FFmpeg before 2.0.1 has an unspecified impact and remote vectors re
CVE-2020-12284 CRITICAL POC
9.8 Apr 28

cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MA
CVE-2026-58049 HIGH POC
8.8 Jun 28

Out-of-bounds heap write in FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) allows attackers to corrupt m
CVE-2021-38094 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacker
CVE-2021-38093 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_robert in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attacke
CVE-2021-38092 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter_prewitt in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
CVE-2021-38091 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_sobel in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows attack
CVE-2021-38090 HIGH POC
8.8 Sep 20

Integer Overflow vulnerability in function filter16_roberts in libavfilter/vf_convolution.c in Ffmpeg 4.2.1, allows atta
CVE-2021-30123 HIGH POC
8.8 Apr 07

FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected

Share

EUVD-2026-54161 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy