Vulnpedia
← All CVEs

CVE-2026-70631

MEDIUM 6.8 ALL-YEARS

Published 2026-08-06 · Last modified 2026-08-14 · VulnCheck · NVD: Analyzed

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.

LIMITED SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 7th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

6.8CVSS 4.0 · MEDIUM · CNA

  • ConfidentialityHigh
  • IntegrityNone
  • AvailabilityNone

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ✓Privileges: No account or privileges required
  • ⚠User interaction: Succeeds with passive user activity
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Ffmpeg

Products Ffmpeg

Weakness (CWE)

  • CWE-908: Use of Uninitialized Resource

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

  • ffmpeg.src as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/ffmpeg?arch=src

    • workaround: Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70631 · Updated 2026-08-14T14:52:17+00:00
  • rhelai3/bootc-aws-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-aws-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9

    • workaround: Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70631 · Updated 2026-08-14T14:52:17+00:00
  • rhelai3/bootc-azure-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9

    • workaround: Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70631 · Updated 2026-08-14T14:52:17+00:00
  • rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-azure-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9

    • workaround: Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70631 · Updated 2026-08-14T14:52:17+00:00
  • rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9

    • workaround: Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70631 · Updated 2026-08-14T14:52:17+00:00
  • rhelai3/bootc-gcp-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gcp-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9

    • workaround: Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70631 · Updated 2026-08-14T14:52:17+00:00
  • rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9

    • workaround: Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70631 · Updated 2026-08-14T14:52:17+00:00
  • rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-vllm-gaudi-rhel9?repository_url=registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9

    • workaround: Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure.
    • none available: Fix deferred
    Red Hat · CVE-2026-70631 · Updated 2026-08-14T14:52:17+00:00

Known Affected Software Configurations

VendorProductVersion range
FfmpegFfmpeg≥ 0.5 and < 9

All CVSS metrics

  • MEDIUM 6.8 v4.0 · CNA Primary
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  • MEDIUM 5.5 v3.1 · CNA Primary
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
  • MEDIUM 6.8 v4.0 · NVD Secondary
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • MEDIUM 5.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS