CVE-2026-70629

Received Received - Intake

Heap Memory Read in FFmpeg RSCC Decoder

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-70629

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	From 3.0 (inc) to 9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability is an uninitialized heap memory read issue in FFmpeg versions 3.0 to 9.0. It occurs in the native RSCC decoder where a crafted video file can cause the decoder to copy heap memory contents into a decoded frame without proper validation. This happens when the decompressed tile data is fewer bytes than required by the tile geometry, leaving uninitialized memory in the output.

Detection Guidance

This vulnerability involves an uninitialized heap memory read in FFmpeg's RSCC decoder. Detection requires analyzing FFmpeg versions between 3.0 and 9.0 for suspicious memory exposure during video decoding. No direct network detection commands exist; focus on version checks and file analysis.

Impact Analysis

This vulnerability could allow attackers to access sensitive data stored in memory, such as previous decoded frames or other heap-allocated information. If exploited, it may lead to information disclosure, potentially exposing confidential or personal data processed by the affected FFmpeg versions.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by enabling unauthorized access to personal or health-related data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. Exploitation of this flaw may lead to data breaches, resulting in legal and regulatory penalties.

Mitigation Strategies

Update FFmpeg to version 9.0 or later to address the uninitialized heap memory read vulnerability in the RSCC decoder. Avoid processing untrusted video files until patched.

Hi! I’m here to help you understand CVE-2026-70629. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70