CVE-2026-70631

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-70631
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70631.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-70631
Downstream
Related
Published
2026-08-06T21:25:53.036Z
Modified
2026-09-03T10:10:55.185161855Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
FFmpeg 0.5 < 9.0 Uninitialized Heap Memory Read in TIFF Decoder
Details

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiffunpackzlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70631.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "0.5"
                },
                {
                    "fixed": "9.0"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "introduced": "0.5"
                },
                {
                    "fixed": "9.0"
                }
            ]
        }
    ],
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-908"
    ]
}
References

Affected packages

Git / git.ffmpeg.org/ffmpeg.git

Affected ranges

Type
GIT
Repo
https://git.ffmpeg.org/ffmpeg.git
Events
Introduced
f8429ed58cefea1669bc127cf2b1905b4893e3f2
Fixed
d32b387f2b0a484599d4587d651891f0c63c4238
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.5"
        },
        {
            "fixed": "9"
        }
    ]
}

Database specific

vanir_signatures 
[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "195688002327067465305765588221319015242",
                "309288324102816931239308632619998175099",
                "208198982209572275918917816535860937592",
                "231555107084919634110330250551123341431",
                "168010716807985158773806969924424380093",
                "204275076296265396432751791373547480918",
                "230743041424433407137898346131591666852",
                "121645463046297428931382762675379161144",
                "64606519716965107927271010747911179138",
                "73767112427060832523002513151109600034",
                "219167262246002076747638059747044171272"
            ],
            "threshold": 0.9
        },
        "source": "https://git.ffmpeg.org/ffmpeg.git@d32b387f2b0a484599d4587d651891f0c63c4238",
        "target": {
            "file": "libavformat/rawutils.c"
        },
        "id": "CVE-2026-70631-bded55e5",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1096.0,
            "function_hash": "95585342688571589449512382820310933372"
        },
        "id": "CVE-2026-70631-bfd07778",
        "target": {
            "function": "ff_reshuffle_raw_rgb",
            "file": "libavformat/rawutils.c"
        },
        "source": "https://git.ffmpeg.org/ffmpeg.git@d32b387f2b0a484599d4587d651891f0c63c4238",
        "signature_version": "v1"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70631.json"
vanir_signatures_modified 
"2026-09-03T08:03:54Z"

Git / github.com/ffmpeg/ffmpeg

Affected ranges

Type
GIT
Repo
https://github.com/ffmpeg/ffmpeg
Events
Introduced
f8429ed58cefea1669bc127cf2b1905b4893e3f2
Fixed
d32b387f2b0a484599d4587d651891f0c63c4238
Database specific
Show details 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.5"
        },
        {
            "fixed": "9"
        }
    ]
}

Database specific

vanir_signatures 
[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1096.0,
            "function_hash": "95585342688571589449512382820310933372"
        },
        "id": "CVE-2026-70631-2a07b12d",
        "target": {
            "function": "ff_reshuffle_raw_rgb",
            "file": "libavformat/rawutils.c"
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/d32b387f2b0a484599d4587d651891f0c63c4238",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "195688002327067465305765588221319015242",
                "309288324102816931239308632619998175099",
                "208198982209572275918917816535860937592",
                "231555107084919634110330250551123341431",
                "168010716807985158773806969924424380093",
                "204275076296265396432751791373547480918",
                "230743041424433407137898346131591666852",
                "121645463046297428931382762675379161144",
                "64606519716965107927271010747911179138",
                "73767112427060832523002513151109600034",
                "219167262246002076747638059747044171272"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-70631-5f4309c9",
        "target": {
            "file": "libavformat/rawutils.c"
        },
        "source": "https://github.com/ffmpeg/ffmpeg/commit/d32b387f2b0a484599d4587d651891f0c63c4238",
        "signature_version": "v1"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70631.json"
vanir_signatures_modified 
"2026-09-03T08:03:54Z"