{"schema":"vulnpedia.research/1","cve":"CVE-2026-70629","references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895","tags":["issue-tracking","Issue Tracking","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.132Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.132Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895"},{"source":"nvd","sourceId":"CVE-2026-70629","modified":"2026-09-01T15:36:14.703","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895"},{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23895"}]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc","tags":["related","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.132Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.132Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc"},{"source":"nvd","sourceId":"CVE-2026-70629","modified":"2026-09-01T15:36:14.703","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc"},{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/533a6198505edd1379e1cd722852350ae4a85acc"}]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7","tags":["patch","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.132Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.132Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7"},{"source":"nvd","sourceId":"CVE-2026-70629","modified":"2026-09-01T15:36:14.703","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7"},{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/cd1f545cf27ba08f6f5b31b1e92665d7874d4fd7"}]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4","tags":["patch","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.132Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.132Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4"},{"source":"nvd","sourceId":"CVE-2026-70629","modified":"2026-09-01T15:36:14.703","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4"},{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a5fe21a1a410a680fe93c33b0dd696b7e1c3aea4"}]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder","tags":["third-party-advisory","Patch","Third Party Advisory"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.132Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.132Z","url":"https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"},{"source":"nvd","sourceId":"CVE-2026-70629","modified":"2026-09-01T15:36:14.703","url":"https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-rscc-decoder"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70629","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-70629"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512256","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512256"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70629","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-70629"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70629"}]},{"source":"euvd","sourceId":"EUVD-2026-54161","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54161","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-54161","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54161"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:ffmpeg.src","product":"ffmpeg.src as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted RSCC-encoded video files using FFmpeg in persistent or multi-tenant services. If decoding untrusted media is required, execute FFmpeg inside an ephemeral container or isolated systemd sandbox to prevent sensitive cross-session heap data exposure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/ffmpeg?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json"}]},{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-aws-cuda-rhel9","product":"rhelai3/bootc-aws-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted RSCC-encoded video files using FFmpeg in persistent or multi-tenant services. If decoding untrusted media is required, execute FFmpeg inside an ephemeral container or isolated systemd sandbox to prevent sensitive cross-session heap data exposure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-aws-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json"}]},{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-azure-cuda-rhel9","product":"rhelai3/bootc-azure-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted RSCC-encoded video files using FFmpeg in persistent or multi-tenant services. If decoding untrusted media is required, execute FFmpeg inside an ephemeral container or isolated systemd sandbox to prevent sensitive cross-session heap data exposure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-azure-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json"}]},{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-azure-rocm-rhel9","product":"rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted RSCC-encoded video files using FFmpeg in persistent or multi-tenant services. If decoding untrusted media is required, execute FFmpeg inside an ephemeral container or isolated systemd sandbox to prevent sensitive cross-session heap data exposure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-azure-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json"}]},{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9","product":"rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted RSCC-encoded video files using FFmpeg in persistent or multi-tenant services. If decoding untrusted media is required, execute FFmpeg inside an ephemeral container or isolated systemd sandbox to prevent sensitive cross-session heap data exposure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json"}]},{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gcp-cuda-rhel9","product":"rhelai3/bootc-gcp-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted RSCC-encoded video files using FFmpeg in persistent or multi-tenant services. If decoding untrusted media is required, execute FFmpeg inside an ephemeral container or isolated systemd sandbox to prevent sensitive cross-session heap data exposure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-gcp-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json"}]},{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9","product":"rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted RSCC-encoded video files using FFmpeg in persistent or multi-tenant services. If decoding untrusted media is required, execute FFmpeg inside an ephemeral container or isolated systemd sandbox to prevent sensitive cross-session heap data exposure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json"}]},{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-vllm-gaudi-rhel9","product":"rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted RSCC-encoded video files using FFmpeg in persistent or multi-tenant services. If decoding untrusted media is required, execute FFmpeg inside an ephemeral container or isolated systemd sandbox to prevent sensitive cross-session heap data exposure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-vllm-gaudi-rhel9?repository_url=registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70629","modified":"2026-08-14T19:03:52+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70629.json"}]}],"vendorCoverage":{"total":8,"shown":8,"omitted":0,"source":"redhat"}}