What’s Vulnerable › Vulnerabilities

CVE-2026-70629: FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-06 · updated 2026-09-01
• Weakness: CWE-908

Description

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.

Affected products

• FFmpeg: from 3.0 before 9 — fixed in 9

How to fix

Upgrade to a fixed version: FFmpeg 9. Check the vendor advisory for mitigations.

References

• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc
• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4
• https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7
• https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895
• https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder

Get alerted when CVE-2026-70629 or the next vulnerability affects your stack