CVE-2026-70629

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-70629
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70629.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-70629
Downstream
Related
Published
2026-08-06T21:25:08.804Z
Modified
2026-09-03T10:10:55.121996412Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
FFmpeg 3.0 < 9.0 Uninitialized Heap Memory Read in RSCC Decoder
Details

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rsccdecodeframe() calls avimagecopyplane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflatedbuf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70629.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.0"
                },
                {
                    "fixed": "9.0"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.0"
                },
                {
                    "fixed": "9.0"
                }
            ]
        }
    ],
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-908"
    ]
}
References

Affected packages

Git / git.ffmpeg.org/ffmpeg.git

Affected ranges

Type
GIT
Repo
https://git.ffmpeg.org/ffmpeg.git
Events
Introduced
c40983a6f631d22fede713d535bb9c31d5c9740c
Fixed
d32b387f2b0a484599d4587d651891f0c63c4238
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.0"
        },
        {
            "fixed": "9"
        }
    ]
}

Database specific

vanir_signatures 
[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "195688002327067465305765588221319015242",
                "309288324102816931239308632619998175099",
                "208198982209572275918917816535860937592",
                "231555107084919634110330250551123341431",
                "168010716807985158773806969924424380093",
                "204275076296265396432751791373547480918",
                "230743041424433407137898346131591666852",
                "121645463046297428931382762675379161144",
                "64606519716965107927271010747911179138",
                "73767112427060832523002513151109600034",
                "219167262246002076747638059747044171272"
            ],
            "threshold": 0.9
        },
        "source": "https://git.ffmpeg.org/ffmpeg.git@d32b387f2b0a484599d4587d651891f0c63c4238",
        "target": {
            "file": "libavformat/rawutils.c"
        },
        "id": "CVE-2026-70629-bded55e5",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1096.0,
            "function_hash": "95585342688571589449512382820310933372"
        },
        "id": "CVE-2026-70629-bfd07778",
        "target": {
            "function": "ff_reshuffle_raw_rgb",
            "file": "libavformat/rawutils.c"
        },
        "source": "https://git.ffmpeg.org/ffmpeg.git@d32b387f2b0a484599d4587d651891f0c63c4238",
        "signature_version": "v1"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70629.json"
vanir_signatures_modified 
"2026-09-03T08:03:53Z"

Git / github.com/ffmpeg/ffmpeg

Affected ranges

Type
GIT
Repo
https://github.com/ffmpeg/ffmpeg
Events
Introduced
c40983a6f631d22fede713d535bb9c31d5c9740c
Fixed
d32b387f2b0a484599d4587d651891f0c63c4238
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.0"
        },
        {
            "fixed": "9"
        }
    ]
}

Database specific

vanir_signatures 
[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1096.0,
            "function_hash": "95585342688571589449512382820310933372"
        },
        "id": "CVE-2026-70629-2a07b12d",
        "target": {
            "function": "ff_reshuffle_raw_rgb",
            "file": "libavformat/rawutils.c"
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/d32b387f2b0a484599d4587d651891f0c63c4238",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "195688002327067465305765588221319015242",
                "309288324102816931239308632619998175099",
                "208198982209572275918917816535860937592",
                "231555107084919634110330250551123341431",
                "168010716807985158773806969924424380093",
                "204275076296265396432751791373547480918",
                "230743041424433407137898346131591666852",
                "121645463046297428931382762675379161144",
                "64606519716965107927271010747911179138",
                "73767112427060832523002513151109600034",
                "219167262246002076747638059747044171272"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/d32b387f2b0a484599d4587d651891f0c63c4238",
        "target": {
            "file": "libavformat/rawutils.c"
        },
        "id": "CVE-2026-70629-5f4309c9",
        "signature_version": "v1"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70629.json"
vanir_signatures_modified 
"2026-09-03T08:03:53Z"