CVE-2026-70631

Received Received - Intake

Heap Memory Disclosure in FFmpeg TIFF Decoder

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-70631

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	From 0.5 (inc) to 9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability affects FFmpeg versions from 0.5 to 9.0. It involves an uninitialized heap memory disclosure issue in the native TIFF decoder. An attacker can exploit this by providing a crafted TIFF file with a Deflate-compressed strip that decompresses fewer bytes than declared. The function allocates a buffer for the full strip but copies all declared rows, leaving unwritten bytes that may contain sensitive data from prior heap allocations.

Detection Guidance

This vulnerability can be detected by checking the installed FFmpeg version. If your version is between 0.5 and 9.0, it is vulnerable. Run: ffmpeg -version. If the output shows a version below 9.0, the system is affected.

Impact Analysis

If you use FFmpeg to decode TIFF files, an attacker could craft a file that exposes sensitive data from memory in the decoded image output. This could lead to information leaks, potentially revealing confidential or personal data processed by your system.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating GDPR and HIPAA requirements for data protection. Organizations processing such data may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade FFmpeg to version 9.0 or later to address the uninitialized heap memory disclosure vulnerability in the TIFF decoder. Avoid processing untrusted TIFF files until the update is applied.

Hi! I’m here to help you understand CVE-2026-70631. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70