{"schema":"vulnpedia.research/1","cve":"CVE-2026-70631","references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899","tags":["issue-tracking","Issue Tracking","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:33.474Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:33.474Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899"},{"source":"nvd","sourceId":"CVE-2026-70631","modified":"2026-09-01T15:33:18.453","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899"},{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23899"}]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7","tags":["related","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:33.474Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:33.474Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7"},{"source":"nvd","sourceId":"CVE-2026-70631","modified":"2026-09-01T15:33:18.453","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7"},{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a991b1fecbd8c9e6f4fc31c191bd12e4be27dbf7"}]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f","tags":["patch","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:33.474Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:33.474Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f"},{"source":"nvd","sourceId":"CVE-2026-70631","modified":"2026-09-01T15:33:18.453","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f"},{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2f234ea34c81288e3840fca632dd16481d8de39f"}]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb","tags":["patch","Patch","vendor-reference"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:33.474Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:33.474Z","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb"},{"source":"nvd","sourceId":"CVE-2026-70631","modified":"2026-09-01T15:33:18.453","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb"},{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/3c287af3affe1286350faa69c02bcc5d49de18bb"}]},{"url":"https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder","tags":["third-party-advisory","Patch","Third Party Advisory"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:33.474Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-08-14T16:51:33.474Z","url":"https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"},{"source":"nvd","sourceId":"CVE-2026-70631","modified":"2026-09-01T15:33:18.453","url":"https://www.vulncheck.com/advisories/ffmpeg-uninitialized-heap-memory-read-in-tiff-decoder"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-70631","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-70631"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512210","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512210"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-70631","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-70631"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70631"}]},{"source":"euvd","sourceId":"EUVD-2026-54164","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54164","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-54164","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54164"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:ffmpeg.src","product":"ffmpeg.src as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/ffmpeg?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json"}]},{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-aws-cuda-rhel9","product":"rhelai3/bootc-aws-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-aws-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json"}]},{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-azure-cuda-rhel9","product":"rhelai3/bootc-azure-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-azure-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json"}]},{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-azure-rocm-rhel9","product":"rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-azure-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json"}]},{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-cuda-rhel9","product":"rhelai3/bootc-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json"}]},{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-gcp-cuda-rhel9","product":"rhelai3/bootc-gcp-cuda-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-gcp-cuda-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-gcp-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json"}]},{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9","product":"rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/bootc-rocm-rhel9?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json"}]},{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-vllm-gaudi-rhel9","product":"rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Avoid processing untrusted TIFF files using FFmpeg in persistent or shared-process services. If processing untrusted media is required, isolate FFmpeg execution within an ephemeral container or tightly restricted systemd/SELinux sandbox to prevent cross-session memory disclosure."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-vllm-gaudi-rhel9?repository_url=registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-70631","modified":"2026-08-14T14:52:17+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-70631.json"}]}],"vendorCoverage":{"total":8,"shown":8,"omitted":0,"source":"redhat"}}