Heap Write Vulnerability in FFmpeg CineForm Decoder

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-70632

Affected Vendors & Products

Vendor	Product	Version / Range
ffmpeg	ffmpeg	to 9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds heap write flaw in FFmpeg versions 4.4 to 9.0. It occurs in the GoPro CineForm HD decoder when processing crafted AVI files. The cfhd_decode function fails to enforce width limits during video frame reconstruction, causing memory corruption that can lead to arbitrary code execution.

Impact Analysis

Attackers could exploit this by tricking users into opening malicious AVI files, potentially leading to system compromise, data theft, or malware execution. The vulnerability requires user interaction but can affect any system processing untrusted media files.

Mitigation Strategies

Upgrade FFmpeg to version 9.0 or later to address the out-of-bounds heap write vulnerability in the CineForm HD decoder.

Hi! I’m here to help you understand CVE-2026-70632. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70