{"schema":"vulnpedia.research/1","cve":"CVE-2026-70630","references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896","tags":["issue-tracking","Issue Tracking","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.804Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.804Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896"},{"source":"nvd","sourceId":"CVE-2026-70630","modified":"2026-09-01T15:35:24.127","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896"},{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23896"}]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa","tags":["related","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.804Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.804Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa"},{"source":"nvd","sourceId":"CVE-2026-70630","modified":"2026-09-01T15:35:24.127","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa"},{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/9a3202a98b2e095b54dd784c3e01a09a676fc3fa"}]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e","tags":["patch","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.804Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.804Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e"},{"source":"nvd","sourceId":"CVE-2026-70630","modified":"2026-09-01T15:35:24.127","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e"},{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/705890061467ad550ecc1dad5eea07f28ccfb43e"}]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62","tags":["patch","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.804Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.804Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62"},{"source":"nvd","sourceId":"CVE-2026-70630","modified":"2026-09-01T15:35:24.127","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62"},{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c22667d0fd7916a33fd3e79685b7246fc48f1a62"}]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder","tags":["third-party-advisory","Patch","Third Party Advisory"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.804Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:32.804Z","url":"https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"},{"source":"nvd","sourceId":"CVE-2026-70630","modified":"2026-09-01T15:35:24.127","url":"https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-screenpresso-decoder"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70630","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-70630"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512259","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512259"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70630","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-70630"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70630"}]},{"source":"euvd","sourceId":"EUVD-2026-54162","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54162","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-54162","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54162"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:ffmpeg.src","product":"ffmpeg.src as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/ffmpeg?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json"}]},{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-aws-cuda-rhel9","product":"rhelai3/bootc-aws-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-aws-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json"}]},{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-azure-cuda-rhel9","product":"rhelai3/bootc-azure-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-azure-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json"}]},{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-azure-rocm-rhel9","product":"rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-azure-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json"}]},{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9","product":"rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json"}]},{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gcp-cuda-rhel9","product":"rhelai3/bootc-gcp-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-gcp-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json"}]},{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9","product":"rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json"}]},{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-vllm-gaudi-rhel9","product":"rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid decoding untrusted Screenpresso (SPV1) media files using FFmpeg in persistent services. If processing untrusted input is required, run FFmpeg inside an ephemeral container or restricted systemd sandbox to prevent sensitive cross-session heap data disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-vllm-gaudi-rhel9?repository_url=registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70630","modified":"2026-08-19T17:41:14+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70630.json"}]}],"vendorCoverage":{"total":8,"shown":8,"omitted":0,"source":"redhat"}}