Vulnpedia
← All CVEs

CVE-2026-70630

MEDIUM 6.8 ALL-YEARS

Published 2026-08-06 · Last modified 2026-08-14 · VulnCheck · NVD: Analyzed

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services.

LIMITED SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 7th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

6.8CVSS 4.0 · MEDIUM · CNA

  • ConfidentialityHigh
  • IntegrityNone
  • AvailabilityNone

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ✓Privileges: No account or privileges required
  • ⚠User interaction: Succeeds with passive user activity
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Ffmpeg

Products Ffmpeg

Weakness (CWE)

  • CWE-908: Use of Uninitialized Resource

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

  • ffmpeg.src as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/ffmpeg?arch=src

    • workaround: Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70630 · Updated 2026-08-19T17:41:14+00:00
  • rhelai3/bootc-aws-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-aws-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9

    • workaround: Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70630 · Updated 2026-08-19T17:41:14+00:00
  • rhelai3/bootc-azure-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9

    • workaround: Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70630 · Updated 2026-08-19T17:41:14+00:00
  • rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9

    • workaround: Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70630 · Updated 2026-08-19T17:41:14+00:00
  • rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9

    • workaround: Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70630 · Updated 2026-08-19T17:41:14+00:00
  • rhelai3/bootc-gcp-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gcp-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9

    • workaround: Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70630 · Updated 2026-08-19T17:41:14+00:00
  • rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9

    • workaround: Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70630 · Updated 2026-08-19T17:41:14+00:00
  • rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-vllm-gaudi-rhel9?repository_url=registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9

    • workaround: Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70630 · Updated 2026-08-19T17:41:14+00:00

Known Affected Software Configurations

VendorProductVersion range
FfmpegFfmpeg≥ 3.0 and < 9

All CVSS metrics

  • MEDIUM 6.8 v4.0 · CNA Primary
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  • MEDIUM 5.5 v3.1 · CNA Primary
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
  • MEDIUM 6.8 v4.0 · NVD Secondary
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • MEDIUM 5.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS