FFmpeg EUVD-2026-54164

Exploitation requires that an attacker can cause FFmpeg to process a crafted TIFF file containing a Deflate-compressed strip whose compressed payload inflates to fewer bytes than the strip's declared dimensions. This does not require a malformed zlib stream - the compressed data must be structurally valid and decompress without error; only the byte count is engineered to fall short of the declared strip size. The attacker must additionally be able to retrieve the decoded output image to observe the leaked heap bytes embedded in the strip rows. Exploitation is most realistic in server-side image processing pipelines where untrusted TIFF files are accepted as input and processed output is returned to the submitter. No prior system authentication, elevated privileges, or non-default FFmpeg configuration is required - the TIFF format with Deflate strip compression is a standard, widely-supported TIFF variant enabled by default. The key limiting factor is AV:L (local): the crafted file must reach the FFmpeg process, which in practice means either direct filesystem access or indirect delivery through a service that passes user-supplied data to FFmpeg. Services that process TIFF in-process and expose output are the realistic threat surface; offline batch processing with no output retrieval path is not exploitable for data leakage.

The CVSS 4.0 score of 6.8 with VC:H accurately signals a meaningful confidentiality risk, but the local attack vector (AV:L) and required user interaction (UI:P) substantially limit mass exploitation. The practical risk is heavily deployment-dependent: in server-side FFmpeg pipelines that ingest untrusted TIFF files and return processed output, this vulnerability enables incremental heap harvesting with no authentication required and low attack complexity - a realistic, repeatable primitive against exposed services. In offline or desktop contexts, the attacker must already control the file being processed, reducing the threat considerably. No EPSS score was available in the provided data, so exploitation probability cannot be quantified; absence of a CISA KEV listing suggests no observed widespread exploitation at time of analysis. The gap between the high VC:H rating and the moderate overall score is consistent with the local-only delivery constraint suppressing the base score. No conflicting signals were identified between the CVSS vector and the vulnerability description - both consistently indicate file-based local delivery requiring a processing trigger.

An attacker targeting a media transcoding API submits a crafted TIFF file whose Deflate-compressed strip is engineered to inflate successfully but produce fewer bytes than the declared strip dimensions require. FFmpeg's tiff_unpack_zlib() decompresses the strip without error, then executes memcpy() over the full declared size, embedding stale bytes from prior heap allocations into the decoded pixel rows. The attacker retrieves the processed output image and inspects anomalous pixel values in the affected strip region to recover fragments of in-process heap data - potentially including credentials, session tokens, or data from prior requests. No confirmed public proof-of-concept was identified, but the primitive is straightforward to construct given the upstream commit diff.