Vulnerability-Lookup

CVE-2026-70632 (GCVE-0-2026-70632)

Vulnerability from cvelistv5 – Published: 2026-08-06 21:26 – Updated: 2026-08-14 16:51 X_Open Source

Title

FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing

Summary

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-07 17:19 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

VulnCheck mitre root

References

5 references

URL	Tags
https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898	issue-tracking
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006…	related
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05…	patch
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2…	patch
https://www.vulncheck.com/advisories/ffmpeg-heap-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
FFmpeg	FFmpeg	Affected: 4.4 , < 9.0 (custom) cpe:2.3:a:ffmpeg:ffmpeg::::::::

Date Public

2026-07-24 00:00

Credits

Adrian Junge (vurlo)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-70632",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T17:19:36.712402Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T17:20:24.373Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/FFmpeg/FFmpeg",
          "product": "FFmpeg",
          "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThan": "9.0",
              "status": "affected",
              "version": "4.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "9.0",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adrian Junge (vurlo)"
        }
      ],
      "datePublic": "2026-07-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T16:51:34.123Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898"
        },
        {
          "name": "Introducing Commit",
          "tags": [
            "related"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087"
        },
        {
          "name": "FFmpeg 9.0 Backport Commit",
          "tags": [
            "patch"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "FFmpeg 4.4 \u003c 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-70632",
    "datePublished": "2026-08-06T21:26:17.466Z",
    "dateReserved": "2026-08-04T20:17:18.297Z",
    "dateUpdated": "2026-08-14T16:51:34.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-70632",
      "date": "2026-09-16",
      "epss": "0.00202",
      "percentile": "0.10339"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-70632\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2026-08-06T22:18:27.567\",\"lastModified\":\"2026-09-01T15:32:31.087\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.\"}],\"affected\":[{\"source\":\"disclosure@vulncheck.com\",\"affectedData\":[{\"vendor\":\"FFmpeg\",\"product\":\"FFmpeg\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://code.ffmpeg.org/FFmpeg/FFmpeg\",\"packageURL\":\"pkg:github/FFmpeg/FFmpeg\",\"versions\":[{\"version\":\"4.4\",\"lessThan\":\"9.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-07T17:19:36.712402Z\",\"id\":\"CVE-2026-70632\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.4\",\"versionEndExcluding\":\"9\",\"matchCriteriaId\":\"972C212B-949F-43B1-BE5C-57EDFB75A533\"}]}]}],\"references\":[{\"url\":\"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-19T16:53:42+00:00",
      "cve": "CVE-2026-70632",
      "id": "CVE-2026-70632",
      "initial_release_date": "2026-08-06T21:26:17.466000+00:00",
      "product_status:known_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ffmpeg: FFmpeg: Arbitrary Code Execution in CFHD Decoder via Crafted AVI File",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70632.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:32:28Z",
      "cve": "CVE-2026-70632",
      "id": "CVE-2026-70632",
      "initial_release_date": "2026-08-07T16:58:52Z",
      "product_status:known_affected": "37",
      "product_status:known_not_affected": "428",
      "product_status:recommended": "144",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-70632",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-70632.json",
      "version": "4"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-70632\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-07T17:19:36.712402Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-07T17:20:09.782Z\"}}], \"cna\": {\"tags\": [\"x_open-source\"], \"title\": \"FFmpeg 4.4 \u003c 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Adrian Junge (vurlo)\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.5, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://code.ffmpeg.org/FFmpeg/FFmpeg\", \"vendor\": \"FFmpeg\", \"product\": \"FFmpeg\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.4\", \"lessThan\": \"9.0\", \"versionType\": \"custom\"}], \"packageURL\": \"pkg:github/FFmpeg/FFmpeg\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-07-24T00:00:00.000Z\", \"references\": [{\"url\": \"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898\", \"name\": \"Pull Request\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e\", \"name\": \"Introducing Commit\", \"tags\": [\"related\"]}, {\"url\": \"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087\", \"name\": \"Patch Commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9\", \"name\": \"FFmpeg 9.0 Backport Commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-08-07T17:12:19.493Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-70632\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-07T17:20:24.373Z\", \"dateReserved\": \"2026-08-04T20:17:18.297Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-08-06T21:26:17.466Z\", \"assignerShortName\": \"VulnCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CNVD-2026-34245

Vulnerability from cnvd - Published: 2026-08-28

Title

FFmpeg缓冲区溢出漏洞（CNVD-2026-34245）

Description

FFmpeg是FFmpeg的一款开源多媒体处理工具。 FFmpeg 4.4至9.0之前版本存在安全漏洞，该漏洞源于CFHD解码器在解析特定格式时存在堆越界写入缺陷。攻击者可利用该漏洞通过提供特制的AVI文件导致堆内存破坏，进而可能实现任意代码执行。

Severity

高

Patch Name

FFmpeg缓冲区溢出漏洞（CNVD-2026-34245）的补丁

Patch Description

FFmpeg是FFmpeg的一款开源多媒体处理工具。 FFmpeg 4.4至9.0之前版本存在安全漏洞，该漏洞源于CFHD解码器在解析特定格式时存在堆越界写入缺陷。攻击者可利用该漏洞通过提供特制的AVI文件导致堆内存破坏，进而可能实现任意代码执行。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898

Reference

https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898 https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087 https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9

Impacted products

Name
FFmpeg FFmpeg >=4.4，<9.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-70632",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-70632"
    }
  },
  "description": "FFmpeg\u662fFFmpeg\u7684\u4e00\u6b3e\u5f00\u6e90\u591a\u5a92\u4f53\u5904\u7406\u5de5\u5177\u3002\n\nFFmpeg 4.4\u81f39.0\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eCFHD\u89e3\u7801\u5668\u5728\u89e3\u6790\u7279\u5b9a\u683c\u5f0f\u65f6\u5b58\u5728\u5806\u8d8a\u754c\u5199\u5165\u7f3a\u9677\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u63d0\u4f9b\u7279\u5236\u7684AVI\u6587\u4ef6\u5bfc\u81f4\u5806\u5185\u5b58\u7834\u574f\uff0c\u8fdb\u800c\u53ef\u80fd\u5b9e\u73b0\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\nhttps://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-34245",
  "openTime": "2026-08-28",
  "patchDescription": "FFmpeg\u662fFFmpeg\u7684\u4e00\u6b3e\u5f00\u6e90\u591a\u5a92\u4f53\u5904\u7406\u5de5\u5177\u3002\r\n\r\nFFmpeg 4.4\u81f39.0\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eCFHD\u89e3\u7801\u5668\u5728\u89e3\u6790\u7279\u5b9a\u683c\u5f0f\u65f6\u5b58\u5728\u5806\u8d8a\u754c\u5199\u5165\u7f3a\u9677\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u63d0\u4f9b\u7279\u5236\u7684AVI\u6587\u4ef6\u5bfc\u81f4\u5806\u5185\u5b58\u7834\u574f\uff0c\u8fdb\u800c\u53ef\u80fd\u5b9e\u73b0\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "FFmpeg\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2026-34245\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "FFmpeg FFmpeg \u003e=4.4\uff0c\u003c9.0"
  },
  "referenceLink": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898\r\nhttps://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e\r\nhttps://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087\r\nhttps://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9",
  "serverity": "\u9ad8",
  "submitTime": "2026-08-12",
  "title": "FFmpeg\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2026-34245\uff09"
}

FKIE_CVE-2026-70632

Vulnerability from fkie_nvd - Published: 2026-08-06 22:18 - Updated: 2026-09-01 15:32

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
disclosure@vulncheck.com	https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e	Patch
disclosure@vulncheck.com	https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9	Patch
disclosure@vulncheck.com	https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087	Patch
disclosure@vulncheck.com	https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898	Issue Tracking, Patch
disclosure@vulncheck.com	https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing	Patch, Third Party Advisory

Impacted products

	Vendor	Product	Version
	ffmpeg	ffmpeg	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/FFmpeg/FFmpeg",
          "product": "FFmpeg",
          "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThan": "9.0",
              "status": "affected",
              "version": "4.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "972C212B-949F-43B1-BE5C-57EDFB75A533",
              "versionEndExcluding": "9",
              "versionStartIncluding": "4.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer."
    }
  ],
  "id": "CVE-2026-70632",
  "lastModified": "2026-09-01T15:32:31.087",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-70632",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-07T17:19:36.712402Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-06T22:18:27.567",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch"
      ],
      "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch"
      ],
      "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch"
      ],
      "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

GHSA-Q24X-99V6-6HXC

Vulnerability from github – Published: 2026-08-07 00:31 – Updated: 2026-08-07 18:31

Details

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.5 (High)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-70632"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-06T22:18:27Z",
    "severity": "HIGH"
  },
  "details": "FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.",
  "id": "GHSA-q24x-99v6-6hxc",
  "modified": "2026-08-07T18:31:42Z",
  "published": "2026-08-07T00:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70632"
    },
    {
      "type": "WEB",
      "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1006a2151236f9235bf02822f263b3fb0532111e"
    },
    {
      "type": "WEB",
      "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/16b2049d4d5222db6cd7c031409058571c94f6a9"
    },
    {
      "type": "WEB",
      "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/db05df9d135fb56a4babb836d5e9f5c1d984e087"
    },
    {
      "type": "WEB",
      "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23898"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-cfhd-decoder-via-avi-demuxing"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

oesa-2026-3638

Vulnerability from osv_openeuler

Published

2026-09-05 15:03

Modified

2026-09-05 15:03

Summary

ffmpeg security update

Details

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.

Security Fix(es):

FFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.(CVE-2026-70628)

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.(CVE-2026-70631)

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-70628	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-70631	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-70632	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "ffmpeg-6.1.1-48.oe2403sp1.aarch64.rpm",
          "ffmpeg-debuginfo-6.1.1-48.oe2403sp1.aarch64.rpm",
          "ffmpeg-debugsource-6.1.1-48.oe2403sp1.aarch64.rpm",
          "ffmpeg-devel-6.1.1-48.oe2403sp1.aarch64.rpm",
          "ffmpeg-libs-6.1.1-48.oe2403sp1.aarch64.rpm",
          "libavdevice-6.1.1-48.oe2403sp1.aarch64.rpm"
        ],
        "src": [
          "ffmpeg-6.1.1-48.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "ffmpeg-6.1.1-48.oe2403sp1.x86_64.rpm",
          "ffmpeg-debuginfo-6.1.1-48.oe2403sp1.x86_64.rpm",
          "ffmpeg-debugsource-6.1.1-48.oe2403sp1.x86_64.rpm",
          "ffmpeg-devel-6.1.1-48.oe2403sp1.x86_64.rpm",
          "ffmpeg-libs-6.1.1-48.oe2403sp1.x86_64.rpm",
          "libavdevice-6.1.1-48.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "ffmpeg",
        "purl": "pkg:rpm/openEuler/ffmpeg\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.1-48.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nFFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.(CVE-2026-70628)\n\nFFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.(CVE-2026-70631)\n\nFFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.(CVE-2026-70632)",
  "id": "OESA-2026-3638",
  "modified": "2026-09-05T15:03:23Z",
  "published": "2026-09-05T15:03:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3638"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70628"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70631"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70632"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ffmpeg security update",
  "upstream": [
    "CVE-2026-70628",
    "CVE-2026-70631",
    "CVE-2026-70632"
  ]
}

oesa-2026-3639

Vulnerability from osv_openeuler

Published

2026-09-05 15:03

Modified

2026-09-05 15:03

Summary

ffmpeg security update

Details

Security Fix(es):

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-70628	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-70631	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-70632	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "ffmpeg-6.1.1-48.oe2403sp3.aarch64.rpm",
          "ffmpeg-debuginfo-6.1.1-48.oe2403sp3.aarch64.rpm",
          "ffmpeg-debugsource-6.1.1-48.oe2403sp3.aarch64.rpm",
          "ffmpeg-devel-6.1.1-48.oe2403sp3.aarch64.rpm",
          "ffmpeg-libs-6.1.1-48.oe2403sp3.aarch64.rpm",
          "libavdevice-6.1.1-48.oe2403sp3.aarch64.rpm"
        ],
        "src": [
          "ffmpeg-6.1.1-48.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "ffmpeg-6.1.1-48.oe2403sp3.x86_64.rpm",
          "ffmpeg-debuginfo-6.1.1-48.oe2403sp3.x86_64.rpm",
          "ffmpeg-debugsource-6.1.1-48.oe2403sp3.x86_64.rpm",
          "ffmpeg-devel-6.1.1-48.oe2403sp3.x86_64.rpm",
          "ffmpeg-libs-6.1.1-48.oe2403sp3.x86_64.rpm",
          "libavdevice-6.1.1-48.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "ffmpeg",
        "purl": "pkg:rpm/openEuler/ffmpeg\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.1-48.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nFFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.(CVE-2026-70628)\n\nFFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.(CVE-2026-70631)\n\nFFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.(CVE-2026-70632)",
  "id": "OESA-2026-3639",
  "modified": "2026-09-05T15:03:24Z",
  "published": "2026-09-05T15:03:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3639"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70628"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70631"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70632"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ffmpeg security update",
  "upstream": [
    "CVE-2026-70628",
    "CVE-2026-70631",
    "CVE-2026-70632"
  ]
}

oesa-2026-3799

Vulnerability from osv_openeuler

Published

2026-09-14 16:34

Modified

2026-09-14 16:34

Summary

ffmpeg security update

Details

Security Fix(es):

A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.(CVE-2026-18393)

A flaw was found in FFmpeg. An integer overflow in the libavfilter/vf_scale.c component allows attackers to cause a Denial of Service (DoS) by supplying a specially crafted video file. This can lead to the application becoming unresponsive or crashing.(CVE-2026-38343)

A flaw was found in FFmpeg. This vulnerability involves a NULL pointer dereference within the get_min_buffer_size function when processing specially crafted video files. An attacker could exploit this by providing a malicious video file, leading to a Denial of Service (DoS). A Denial of Service attack prevents legitimate users from accessing a service or resource.(CVE-2026-38344)

A flaw was found in FFmpeg. An integer overflow vulnerability in the yuv2planeX_8_c() function allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted video file. This can lead to the application becoming unresponsive or crashing, impacting system availability.(CVE-2026-38346)

A flaw was found in FFmpeg. A heap overflow vulnerability exists in the ff_sws_alphablendaway function. This flaw allows attackers to cause a Denial of Service (DoS) by providing a specially crafted input. Successful exploitation could lead to the application becoming unresponsive or crashing.(CVE-2026-38347)

A flaw was found in FFmpeg, specifically within the libswscale/utils.c component. An integer overflow vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted image file. This could lead to the application becoming unresponsive or crashing.(CVE-2026-38348)

A flaw was found in FFmpeg. An integer overflow vulnerability in the hScale16To19_c() function allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted image file. This can lead to the application becoming unresponsive or crashing, preventing legitimate users from accessing the service.(CVE-2026-38349)

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-18393	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-38343	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-38344	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-38346	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-38347	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-38348	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-38349	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-70628	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-70631	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-70632	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "ffmpeg-6.1.1-49.oe2403sp4.aarch64.rpm",
          "ffmpeg-debuginfo-6.1.1-49.oe2403sp4.aarch64.rpm",
          "ffmpeg-debugsource-6.1.1-49.oe2403sp4.aarch64.rpm",
          "ffmpeg-devel-6.1.1-49.oe2403sp4.aarch64.rpm",
          "ffmpeg-libs-6.1.1-49.oe2403sp4.aarch64.rpm",
          "libavdevice-6.1.1-49.oe2403sp4.aarch64.rpm"
        ],
        "src": [
          "ffmpeg-6.1.1-49.oe2403sp4.src.rpm"
        ],
        "x86_64": [
          "ffmpeg-6.1.1-49.oe2403sp4.x86_64.rpm",
          "ffmpeg-debuginfo-6.1.1-49.oe2403sp4.x86_64.rpm",
          "ffmpeg-debugsource-6.1.1-49.oe2403sp4.x86_64.rpm",
          "ffmpeg-devel-6.1.1-49.oe2403sp4.x86_64.rpm",
          "ffmpeg-libs-6.1.1-49.oe2403sp4.x86_64.rpm",
          "libavdevice-6.1.1-49.oe2403sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "ffmpeg",
        "purl": "pkg:rpm/openEuler/ffmpeg\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.1-49.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC cursor data. A remote attacker could exploit this by supplying a specially crafted video file, potentially leading to a denial of service or arbitrary code execution.(CVE-2026-18393)\n\nA flaw was found in FFmpeg. An integer overflow in the `libavfilter/vf_scale.c` component allows attackers to cause a Denial of Service (DoS) by supplying a specially crafted video file. This can lead to the application becoming unresponsive or crashing.(CVE-2026-38343)\n\nA flaw was found in FFmpeg. This vulnerability involves a NULL pointer dereference within the `get_min_buffer_size` function when processing specially crafted video files. An attacker could exploit this by providing a malicious video file, leading to a Denial of Service (DoS). A Denial of Service attack prevents legitimate users from accessing a service or resource.(CVE-2026-38344)\n\nA flaw was found in FFmpeg. An integer overflow vulnerability in the `yuv2planeX_8_c()` function allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted video file. This can lead to the application becoming unresponsive or crashing, impacting system availability.(CVE-2026-38346)\n\nA flaw was found in FFmpeg. A heap overflow vulnerability exists in the `ff_sws_alphablendaway` function. This flaw allows attackers to cause a Denial of Service (DoS) by providing a specially crafted input. Successful exploitation could lead to the application becoming unresponsive or crashing.(CVE-2026-38347)\n\nA flaw was found in FFmpeg, specifically within the libswscale/utils.c component. An integer overflow vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted image file. This could lead to the application becoming unresponsive or crashing.(CVE-2026-38348)\n\nA flaw was found in FFmpeg. An integer overflow vulnerability in the `hScale16To19_c()` function allows a remote attacker to cause a Denial of Service (DoS) by supplying a specially crafted image file. This can lead to the application becoming unresponsive or crashing, preventing legitimate users from accessing the service.(CVE-2026-38349)\n\nFFmpeg versions from 0.5 up to, but not including, 9.0 contain a signed integer overflow vulnerability in the DVB subtitle parser in libavcodec/dvbsub_parser.c that allows attackers to trigger a heap buffer overflow by supplying a crafted WTV file. The overflow causes the bounds-check guard expression to wrap to INT_MIN, bypassing the PARSE_BUF_SIZE comparison and invoking memcpy() with attacker-controlled data into a heap buffer, resulting in an out-of-bounds heap write and potential memory corruption or code execution.(CVE-2026-70628)\n\nFFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.(CVE-2026-70631)\n\nFFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap memory by supplying a crafted AVI file during stream probing. The cfhd_decode() function fails to enforce the non-Bayer logical output-width invariant in the transform-type-2 reconstruction path, causing horiz_filter_clip() to write oversized 16-bit sample rows far beyond the allocated output frame buffer, which can be escalated to arbitrary code execution via overwrite of a live cleanup callback pointer.(CVE-2026-70632)",
  "id": "OESA-2026-3799",
  "modified": "2026-09-14T16:34:29Z",
  "published": "2026-09-14T16:34:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3799"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18393"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38343"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38344"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38346"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38347"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38348"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-38349"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70628"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70631"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70632"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ffmpeg security update",
  "upstream": [
    "CVE-2026-18393",
    "CVE-2026-38343",
    "CVE-2026-38344",
    "CVE-2026-38346",
    "CVE-2026-38347",
    "CVE-2026-38348",
    "CVE-2026-38349",
    "CVE-2026-70628",
    "CVE-2026-70631",
    "CVE-2026-70632"
  ]
}

OPENSUSE-SU-2026:11659-1

Vulnerability from csaf_opensuse - Published: 2026-09-01 00:00 - Updated: 2026-09-16 21:28

Summary

ffmpeg-9-libavcodec-devel-9.0.1-3.1 on GA media

Severity

Moderate

Scope

12 vulnerabilities in this advisory, including CVE-2026-70632.

CVE-2026-70632

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 60 products

Open the full advisory

OPENSUSE-SU-2026:11665-1

Vulnerability from csaf_opensuse - Published: 2026-09-02 00:00 - Updated: 2026-09-16 21:28

Summary

ffmpeg-7-7.1.5-2.1 on GA media

Severity

Moderate

Scope

29 vulnerabilities in this advisory, including CVE-2026-70632.

CVE-2026-70632

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 68 products

Open the full advisory

OPENSUSE-SU-2026:11682-1

Vulnerability from csaf_opensuse - Published: 2026-09-04 00:00 - Updated: 2026-09-16 21:29

Summary

ffmpeg-8-8.1.2-3.1 on GA media

Severity

Moderate

Scope

21 vulnerabilities in this advisory, including CVE-2026-70632.

CVE-2026-70632

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 88 products

Open the full advisory

OPENSUSE-SU-2026:11716-1

Vulnerability from csaf_opensuse - Published: 2026-09-08 00:00 - Updated: 2026-09-16 21:29

Summary

ffmpeg-4-4.4.8-5.1 on GA media

Severity

Moderate

Scope

9 vulnerabilities in this advisory, including CVE-2026-70632.

CVE-2026-70632

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 80 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-70632 (GCVE-0-2026-70632)

Vulnerability from osv_openeuler

Vulnerability from osv_openeuler

Vulnerability from osv_openeuler

Tags

Sightings

Nomenclature

Related by attack behaviour