FFmpeg: Five Vulnerabilities Disclosed, Two High Severity Heap Corruption Flaws
Five FFmpeg vulnerabilities disclosed on August 6, 2026, including two High severity flaws allowing heap corruption and memory disclosure.
Key findings
- Five FFmpeg vulnerabilities disclosed on August 6, 2026, ranging from Medium to High severity.
- Two High severity flaws (CVE-2026-70632, CVE-2026-70628) involve heap corruption and buffer overflows.
- Three Medium severity flaws (CVE-2026-70631, CVE-2026-70630, CVE-2026-70629) allow uninitialized heap memory disclosure.
- Vulnerabilities affect multiple decoders (CFHD, TIFF, Screenpresso, RSCC) and a parser (DVB subtitle).
- Affected versions range from 0.5, 3.0, and 4.4 up to, but not including, 9.0.
- Update to FFmpeg version 9.0 or later to patch these vulnerabilities.
On August 6, 2026, a batch of five vulnerabilities was disclosed for FFmpeg, a widely used open-source cross-platform solution for handling multimedia data. The vulnerabilities, disclosed on the same day, span across multiple decoders and parsers within FFmpeg's extensive library, with severities ranging from Medium to High. These issues could allow remote attackers to corrupt heap memory, disclose sensitive memory contents, or trigger heap buffer overflows by supplying specially crafted media files.
Two of the disclosed vulnerabilities are rated as High severity (CVSSv3 7.8). CVE-2026-70632, found in the GoPro CineForm HD (CFHD) decoder, involves an out-of-bounds heap write that can occur during stream probing when processing a crafted AVI file. The vulnerability stems from the cfhd_decode() function failing to properly enforce non-Bayer log values. The second High severity vulnerability, CVE-2026-70628, resides in the DVB subtitle parser. It is a signed integer overflow vulnerability in libavcodec/dvbsub_parser.c that can lead to a heap buffer overflow when processing a crafted WTV file, caused by an integer wrap-around in the bounds-check expression.
The remaining three vulnerabilities are classified as Medium severity (CVSSv3 5.5). CVE-2026-70631, located in the TIFF decoder (libavcodec/tiff.c), is an uninitialized heap memory disclosure vulnerability. Attackers can exploit this by providing a crafted TIFF file with a valid Deflate-compressed strip that terminates prematurely, leading to the disclosure of heap memory. Similarly, CVE-2026-70630 in the Screenpresso decoder (libavcodec/screenpresso.c) is an uninitialized heap memory read vulnerability. A crafted SPV1 packet with a zlib stream that decompresses fewer bytes than declared can lead to the recovery of sensitive memory contents. Lastly, CVE-2026-70629, found in the RSCC decoder (libavcodec/rscc.c), is another uninitialized heap memory read vulnerability. By supplying a crafted video file with a compressed tile that decompresses fewer bytes than specified, attackers can disclose heap memory contents.
All five vulnerabilities affect FFmpeg versions from various starting points up to, but not including, version 9.0. The specific affected versions are: CVE-2026-70632 (versions 4.4 to 9.0), CVE-2026-70631 (versions 0.5 to 9.0), CVE-2026-70630 (versions 3.0 to 9.0), CVE-2026-70629 (versions 3.0 to 9.0), and CVE-2026-70628 (versions 0.5 to 9.0). Users are strongly advised to update to FFmpeg version 9.0 or later to mitigate these risks.
This batch of vulnerabilities highlights the importance of thorough security auditing in multimedia processing libraries, which often handle complex and varied file formats. The range of affected components, from image decoders to subtitle parsers, underscores the broad attack surface within FFmpeg. Users relying on FFmpeg for media processing should prioritize updating their installations to the latest patched version to protect against potential memory corruption and information disclosure attacks.